CVE-2022-43396: Apache Kylin vulnerable to Command injection by Useless configuration

December 30, 2022 (updated November 7, 2023)

In the fix for CVE-2022-24697, a block list is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

References

github.com/advisories/GHSA-f5q9-j9r2-34gq
github.com/apache/kylin/pull/2011
lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r
nvd.nist.gov/vuln/detail/CVE-2022-43396

Code Behaviors & Features

Detect and mitigate CVE-2022-43396 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →