Mysql JDBC Connector Deserialize RCE

Vulnerability

Apache Kylin versions 2.6.6 and prior, and 3.1.2 and prior, contain a vulnerability where the MySQL JDBC driver processes certain properties that can be exploited by an attacker to execute arbitrary code. The issue affects Kylin 2.x and 3.x when connecting to a MySQL database. [1][3]

Exploitation

An attacker must control a malicious MySQL server and induce a Kylin server to connect to it via JDBC. The MySQL JDBC driver then deserializes attacker-controlled data, leading to remote code execution within the Kylin server process. No authentication or user interaction beyond initiating the connection is required. [1][3]

Impact

Successful exploitation allows the attacker to execute arbitrary code on the Kylin server, potentially leading to full compromise of the server and access to sensitive data. The attack results in remote code execution. [1][3]

Mitigation

Users should upgrade to Apache Kylin 3.1.3 or apply the patch available at GitHub pull request #1694. No workaround is documented. [3]