Apache Kylin: Session fixation in web interface

Vulnerability

Overview

CVE-2024-23590 is a session fixation vulnerability in the web interface of Apache Kylin, an open-source OLAP engine for big data. The flaw allows an attacker to fixate a session identifier before a legitimate user authenticates, enabling session hijacking after login. This issue affects Apache Kylin versions from 2.0.0 through 4.x [1][3].

Exploitation

An attacker can exploit this vulnerability by first obtaining or crafting a valid session ID (e.g., by visiting the Kylin web interface) and then tricking a victim into using that same session ID, for example via a crafted link or by setting the session cookie. When the victim logs in, the attacker's pre-set session becomes authenticated, granting the attacker access to the victim's session without needing credentials [3].

Impact

Successful exploitation allows an attacker to impersonate an authenticated user, gaining unauthorized access to the Kylin web interface and potentially sensitive data or administrative functions. The severity is rated as low, but the impact can be significant in environments where Kylin is used for critical analytics [1][3].

Mitigation

Apache has addressed this vulnerability in Kylin version 5.0.0. Users are strongly recommended to upgrade to 5.0.0 or later. No workarounds have been provided for earlier versions [1][3].