Apache Kylin: Command injection by Useless configuration

Vulnerability

Overview

CVE-2022-43396 is a blacklist bypass vulnerability in Apache Kylin. The fix for CVE-2022-24697 implemented a blacklist to filter user input commands, but this approach is incomplete and can be circumvented [1]. The root cause is that the blacklist does not adequately block all malicious inputs, leaving the system exposed.

Exploitation

An attacker can control the kylin.engine.spark-cmd configuration parameter to inject arbitrary commands. This parameter is processed by the system without proper validation, bypassing the blacklist filter [1]. The attack likely requires some level of authentication or access to modify configuration parameters, but once achieved, arbitrary command execution follows.

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the Kylin server with the privileges of the Kylin process. This can lead to full system compromise, including data exfiltration, installation of backdoors, or lateral movement within the network.

Mitigation

The issue is addressed in later versions of Apache Kylin. Users should upgrade to a patched version or apply the relevant fix from the project's repository [2]. No workarounds have been publicly identified, and the vulnerability is considered high severity.