Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

Vulnerability

Apache Kylin's cube designer function contains a command injection vulnerability in the configuration overwrites menu. When overwriting system parameters, the application fails to properly sanitize user input, allowing an attacker to close the single quotation marks around the parameter value of --conf= and inject arbitrary operating system commands into the command line. This affects Kylin 2 (up to 2.6.5), Kylin 3 (up to 3.1.2), and Kylin 4 (up to 4.0.1). [1]

Exploitation

To exploit, an attacker must have access to the cube designer function. By crafting a malicious input that closes the existing single quote and appends a new command, the injection is passed to the underlying system shell. No authentication bypass is required for users who can already access the configuration overwrites menu. The attack vector is local or remote depending on deployment, but the cube designer is typically accessible via the web interface. [1]

Impact

Successful exploitation results in remote code execution (RCE) under the privileges of the Kylin process. An attacker can execute arbitrary system commands, potentially leading to full compromise of the Kylin server, data exfiltration, or lateral movement within the network.

Mitigation

The vulnerability is fixed in later versions. Users should upgrade to Kylin 4.0.2 or later (the fix is incorporated in pull request #1811 [4]). For Kylin 2 and 3 users, upgrading to a supported release or applying the relevant patch is recommended. CVE-2022-24697 is distinct from a later bypass (CVE-2022-43396) which required additional hardening. [3]