Hardcoded credentials

Vulnerability

Apache Kylin's PasswordPlaceholderConfigurer class, intended to encrypt user passwords, initializes its cipher with a hardcoded encryption key and initialization vector (IV). This design flaw means that any password encrypted with this class can be decrypted by anyone who knows the hardcoded values. The vulnerability affects Apache Kylin versions 2.6.6 and prior, 3.1.2 and prior, and 4.0.0 and prior [1][3].

Exploitation

An attacker with read access to Kylin's configuration file (e.g., kylin.properties) can extract the encrypted password string. Because the encryption algorithm and its hardcoded key/IV are publicly known or reverse-engineerable from the source code, the attacker can decrypt the password offline without needing any authentication or special privileges beyond file read access [1][3].

Impact

Successful decryption of a stored password leads to disclosure of sensitive credentials. The attacker can then use the cleartext password to gain unauthorized access to Kylin's data sources or internal services, resulting in information disclosure and potential privilege escalation within the affected system [1].

Mitigation

Users of Kylin 2.x and 3.x should upgrade to version 3.1.3 or apply the patch available at the GitHub pull request [3][4]. For Kylin 4.x, users should upgrade to version 4.0.1 or apply the corresponding patch [3][4]. No workaround for unpatched versions is provided in the references; users must avoid hardcoding passwords or use a separate secure secrets management mechanism.