RCE in Apache Kylin
CVE-2021-45456
Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.889 (99.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Kylin — versions 4.0.0
- Apache Software Foundation Kylin — versions Apache Kylin 4 4.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-45456?
- CVE-2021-45456 is a critical-severity vulnerability in Apache Kylin, classified under Command Injection. CVSS score: 9.8/10. Published 2022-01-06.
- How severe is CVE-2021-45456?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2021-45456 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.