CVE-2022-43396: Apache Kylin vulnerable to Command injection by Useless configuration

December 30, 2022 (updated November 7, 2023)

In the fix for CVE-2022-24697, a block list is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.

References

github.com/advisories/GHSA-f5q9-j9r2-34gq
github.com/apache/kylin/pull/2011
lists.apache.org/thread/ob2ks04zl5ms0r44cd74y1xdl1rzfd1r
nvd.nist.gov/vuln/detail/CVE-2022-43396

Code Behaviors & Features

Detect and mitigate CVE-2022-43396 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →