GitHub Advisoryadvisory · Maven

GHSA-ppxx-m926-g569 Apache Kylin vulnerable to remote code execution

CRITICAL Published 2023-07-06 Modified 2025-05-16 Official page ↗
Aliases
CVE-2022-24697
Ecosystem
Maven
Packages
org.apache.kylin:kylin-core-common, org.apache.kylin:kylin-spark-project, org.apache.kylin:kylin-server-base
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2023-07-06

Affected packages

• Maven org.apache.kylin:kylin-core-common: < 4.0.2 → fixed in 4.0.2 • Maven org.apache.kylin:kylin-spark-project: < 4.0.2 → fixed in 4.0.2 • Maven org.apache.kylin:kylin-server-base: < 4.0.2 → fixed in 4.0.2

Description

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.

Related

Alias · CVE (1)

  • CVE-2022-24697 Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites… vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References