CVE-2020-1956

What is Apache Kylin?

Apache Kylin is an open-source distributed analytics engine designed to provide fast OLAP (online analytical processing) queries over massive datasets stored in Hadoop and Spark-based data platforms. It's used by organizations running large-scale business intelligence workloads that need sub-second query response times over billions of rows — infrastructure typically holding a broad view of an organization's business data.

Overview

CVE-2020-1956 is an OS command injection vulnerability (CWE-78) in Apache Kylin. A low-privileged, authenticated attacker can exploit a REST API parameter that is passed into a system-level command without adequate sanitization, executing arbitrary operating system commands on the Kylin server (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High).

Technical Details

Certain Kylin REST API endpoints accept parameters that are used to construct shell commands (for example, related to job diagnosis or query execution management) without properly escaping shell metacharacters, allowing an attacker with low-privileged API access to inject additional commands that the server then executes.

Discovery

Reported through Apache's standard security disclosure process and fixed in a subsequent Kylin release.

Exploitation Context

CISA added this CVE to KEV in March 2022 based on confirmed exploitation. Given Kylin's role as a business intelligence engine with access to an organization's aggregated data, compromise of the server itself can expose far more than the vulnerability's technical description suggests, since the underlying data warehouses it queries are often connected with broad read access.

Remediation

1. Upgrade Apache Kylin to a patched release immediately.
2. Restrict network access to the Kylin REST API to trusted internal services and administrators; it should not be directly internet-facing.
3. Apply the principle of least privilege to Kylin API accounts, since exploitation requires only low-level authenticated access rather than full administrative rights.
4. Review Kylin server logs for anomalous REST API requests containing shell metacharacters in job or query management parameters.