Improper Access Control to Streaming Coordinator & SSRF

Vulnerability

All request mappings in StreamingCoordinatorController.java handling /kylin/api/streaming_coordinator/* REST API endpoints in Apache Kylin 3.x prior to version 3.1.2 lack any security checks [1][3]. This allows an unauthenticated attacker to issue arbitrary requests to the Kylin Coordinator, such as assigning or unassigning streaming cubes, and creating, modifying, or deleting replica sets. For endpoints that accept node details in the HTTP message body, this can lead to unauthenticated (but limited) server-side request forgery (SSRF) [1][3].

Exploitation

An attacker needs only network access to the Kylin Coordinator HTTP endpoint. No authentication or user interaction is required [1][3]. The attacker can issue HTTP requests to the exposed endpoints under /kylin/api/streaming_coordinator/* to perform operations like assigning/unassigning streaming cubes or creating/modifying/deleting replica sets. For endpoints that accept node details in the message body, the attacker can craft requests that trigger a limited SSRF, allowing interactions with internal services [1][3].

Impact

Successful exploitation allows an unauthenticated attacker to manipulate streaming cube assignments and replica set configurations, disrupting or corrupting streaming data processing in Kylin [1][3]. The SSRF capability, while limited, can be used to probe or interact with internal network resources [1][3]. The compromise primarily affects availability and integrity of the streaming coordination functionality; no elevation of privileges is explicitly documented.

Mitigation

Apache Kylin users on 3.x versions should upgrade to version 3.1.3 or apply the patch from pull request #1646 on the Kylin GitHub repository [3][4]. The fix introduces proper authentication checks on the affected REST endpoints. No workaround is documented if upgrading or patching is not immediately possible [3][4].