PT-2020-4073 · Apache · Apache Kylin

Published 2020-05-22 · Updated 2025-10-23 · CVE-2020-1956

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Kylin versions 2.3.0 through 2.6.5 Apache Kylin version 3.0.1

Description: The issue is related to the RESTful APIs in Apache Kylin, which concatenate OS commands with user input strings without proper protection or validation, allowing a user to potentially execute any OS command. This could enable a remote attacker to execute arbitrary commands.

Recommendations: For Apache Kylin versions 2.3.0 through 2.6.5, consider disabling the vulnerable RESTful APIs until a patch is available. For Apache Kylin version 3.0.1, restrict access to the affected APIs to minimize the risk of exploitation. As a temporary workaround, avoid using user input strings in the affected API endpoints until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-04473

CVE-2020-1956

GHSA-GPRM-XQRC-C2J3

Affected Products

Apache Kylin

References · 30

• 🔥 https://github.com/b510/CVE-2020-1956 · Exploit
• 🔥 https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706 · Exploit
• https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E · Patch
• https://osv.dev/vulnerability/GHSA-gprm-xqrc-c2j3 · Vendor Advisory
• https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-1956 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1956 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04473 · Security Note
• https://github.com/apache/kylin · Note
• https://github.com/apache/kylin/commit/58fad56ac6aaa43c6bd8f962d7f2d84438664092 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1956 · Note
• https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb@%3Cuser.kylin.apache.org%3E · Note
• https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb@%3Cannounce.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2020/07/14/1 · Note