Apache Kylin unsafe class loading

Vulnerability

Apache Kylin versions 2.6.6 and prior, 3.1.2 and prior, and 4.0.0 and prior accept user input that is passed to Class.forName(...), allowing an attacker to load arbitrary Java classes [2][3]. No special configuration is required; the vulnerable code path is reachable through normal application input handling.

Exploitation

An attacker with network access to a Kylin instance can send crafted input that specifies a fully qualified class name. The server will then load and potentially instantiate that class via Class.forName, bypassing intended restrictions [3]. No authentication or user interaction is required.

Impact

Successful exploitation can lead to arbitrary class loading, which may result in remote code execution (RCE) in the context of the Kylin server process. This can compromise the confidentiality, integrity, and availability of the system and data [2][3].

Mitigation

Users of Kylin 2.x and 3.x should upgrade to version 3.1.3 or apply the patch at [1]. Users of Kylin 4.x should upgrade to version 4.0.1 or apply the patch at [4]. No other workaround is documented in the references.