CVE-2022-24697: Apache Kylin vulnerable to remote code execution

July 6, 2023 (updated May 16, 2025)

Kylin’s cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “– conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.

References

github.com/advisories/GHSA-ppxx-m926-g569
github.com/apache/kylin
github.com/apache/kylin/pull/1811
lists.apache.org/thread/07mnn9c7o314wrhrwjr10w9j5s82voj4
nvd.nist.gov/vuln/detail/CVE-2022-24697

Code Behaviors & Features

Detect and mitigate CVE-2022-24697 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →