CVE-2020-1956
Apache Kylin OS Command Injection Vulnerability
Description
CVE-2020-1956 is an OS command injection vulnerability in Apache Kylin's REST API that allows authenticated users to execute arbitrary operating system commands on the server. The flaw exists in the way Kylin processes certain API requests, enabling an attacker with valid credentials to inject and execute commands with the privileges of the Kylin service account. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022. With an EPSS score of 97.2% (99.9th percentile), exploitation is near-certain and organizations running Apache Kylin should apply patches immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | kylin | >= 2.3.0, <= 2.3.2; >= 2.5.0, <= 2.5.2; >= 2.6.0, <= 2.6.5; 2.4.0; 2.4.1; 3.0.0; 3.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2020/07/14/1(Mailing List)
- https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706(Exploit, Third Party Advisory)
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E(Mailing List, Patch)
- https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E(Mailing List, Mitigation, Vendor Advisory)
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E(Mailing List, Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1956(Third Party Advisory, US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CVE-2020-1956 falls under CWE-78, which describes vulnerabilities where user-supplied input is incorporated into operating system commands without proper sanitization. Apache Kylin's REST API fails to adequately neutralize special characters in user input, allowing authenticated attackers to inject arbitrary OS commands that are executed by the underlying system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2020-1956 enables authenticated attackers to execute arbitrary OS commands on the Apache Kylin server, potentially leading to full system compromise. The attacker can read sensitive data including database credentials and query results, modify or delete data processed by Kylin, and use the compromised server as a pivot point for lateral movement within the network. While authentication is required, the low attack complexity and network-accessible attack vector mean that any user with valid Kylin credentials can exploit this vulnerability. The EPSS score of 97.2% confirms that exploitation is near-certain for exposed instances, and organizations should treat this as a high-priority remediation target.
Exploit Maturity
CVE-2020-1956 has been confirmed as actively exploited in the wild by CISA. Public exploit code and detailed write-ups are available, significantly lowering the barrier to exploitation. With an EPSS score of 97.2% (99.9th percentile), this vulnerability is among the most likely to be exploited. The combination of a well-documented attack vector, available exploit code, and confirmed wild exploitation makes immediate patching critical.
Remediation
- Upgrade Apache Kylin: Update to Apache Kylin version 3.0.1 or 2.6.6 or later, which contain patches for CVE-2020-1956.
- Restrict API access: Limit access to the Kylin REST API to trusted networks and authorized users only, using network-level controls such as firewalls or VPN requirements.
- Review user accounts and permissions: Audit all Kylin user accounts, remove unnecessary accounts, and apply the principle of least privilege to minimize the attack surface.
- Monitor for exploitation indicators: Review server logs for unusual API requests, unexpected command execution patterns, or signs of unauthorized data access.
- Implement Web Application Firewall rules: Deploy WAF rules to detect and block command injection patterns targeting the Kylin REST API endpoints.
Technical Details
CVE-2020-1956 is an OS command injection vulnerability in the Apache Kylin REST API. The flaw exists because Kylin does not properly sanitize user-supplied input in certain API endpoints before incorporating it into operating system commands executed on the server. An authenticated attacker can craft malicious API requests containing shell metacharacters or command separators that break out of the intended command context and execute arbitrary commands with the privileges of the Kylin service process. The vulnerability follows the classic CWE-78 pattern where untrusted input flows into a system command execution function without adequate filtering or escaping of special characters.
Frequently Asked Questions
Is CVE-2020-1956 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2020-1956 and added it to the Known Exploited Vulnerabilities catalog on March 25, 2022. Public exploit code is available, and the EPSS score of 97.2% indicates near-certain exploitation.
What products are affected by CVE-2020-1956?
CVE-2020-1956 affects Apache Kylin versions prior to 3.0.1 and 2.6.6. Apache Kylin is an open-source distributed analytics engine for big data that provides a SQL interface and multidimensional analysis (OLAP) on Hadoop.
How do I fix CVE-2020-1956?
Upgrade Apache Kylin to version 3.0.1 or 2.6.6 or later. Additionally, restrict REST API access to trusted networks and review all user accounts and permissions to minimize the attack surface.
How severe is CVE-2020-1956?
CVE-2020-1956 is a high-severity OS command injection vulnerability. While authentication is required, the low attack complexity and availability of public exploits make it trivially exploitable for anyone with valid credentials. Successful exploitation leads to full command execution on the server.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.