Homepage

org.apache.kylin:kylin-server@3.0.0-alpha2 vulnerabilities

  • latest version

    5.0.0

  • latest non vulnerable version

    5.0.0

  • first published

    9 years ago

  • latest version published

    4 months ago

  • licenses detected

  • package manager

    View on Maven Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.apache.kylin:kylin-server package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Information Exposure

    org.apache.kylin:kylin-server is an analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis (OLAP) on Hadoop supporting extremely large datasets.

    Affected versions of this package are vulnerable to Information Exposure due to the reflection of the Origin header, which allow credentials to be sent cross-origin in the default configuration.

    PoC:

    // request:

OPTIONS /kylin/api/projects HTTP/1.1
Host: localhost:7070
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: http://b49b-95-62-58-48.ngrok.io/
Origin: http://b49b-95-62-58-48.ngrok.io
Connection: keep-alive
Cache-Control: max-age=0

// reply:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: http://b49b-95-62-58-48.ngrok.io
Access-Control-Allow-Credentials: true
Vary: Origin
Access-Control-Allow-Methods: DELETE, POST, GET, OPTIONS, PUT
Access-Control-Allow-Headers: Authorization, Origin, No-Cache, X-Requested-With, Cache-Control, Accept, X-E4m-With, If-Modified-Since, Pragma, Last-Modified, Expires, Content-Type
Content-Length: 0

    How to fix Information Exposure?

    Upgrade org.apache.kylin:kylin-server to version 3.1.3, 4.0.1 or higher.

    [,3.1.3)[4.0.0-alpha,4.0.1)
    • H
    SQL Injection

    org.apache.kylin:kylin-server is an analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis (OLAP) on Hadoop supporting extremely large datasets.

    Affected versions of this package are vulnerable to SQL Injection. It concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible.

    How to fix SQL Injection?

    Upgrade org.apache.kylin:kylin-server to version 3.1.0 or higher.

    [2.0.0,3.1.0)
    • H
    Command Injection

    org.apache.kylin:kylin-server is an analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis (OLAP) on Hadoop supporting extremely large datasets.

    Affected versions of this package are vulnerable to Command Injection. It one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely.

    How to fix Command Injection?

    Upgrade org.apache.kylin:kylin-server to version 3.1.0 or higher.

    [2.3.0,3.1.0)
    Go back to all versions of this package