CVE-2020-13926

Root

Cause

Apache Kylin concatenates and executes a Hive SQL statement via Hive CLI or beeline when building a new segment. Part of the HQL is derived from system configurations, which can be overwritten by a certain REST API. This design allows an attacker to inject malicious SQL into the Hive query, leading to SQL injection [1][2].

Exploitation

An attacker with network access to the Kylin REST API can overwrite the system configuration values that are incorporated into the Hive SQL. The vulnerability does not require prior authentication if the REST API endpoint is exposed, though the exact prerequisites are not detailed in the sources. The injection occurs during the segment building process, which is a routine operation in Kylin [1][2].

Impact

Successful exploitation enables the attacker to execute arbitrary Hive SQL commands. This could result in unauthorized reading, modification, or deletion of data stored in Hive, potentially compromising the integrity and confidentiality of the underlying data warehouse [1][2].

Mitigation

The vulnerability affects all Kylin versions after 2.0 up to 3.0.1. Users are advised to upgrade to version 3.1.0, which contains the fix. No workarounds are mentioned in the available references [2].