CVE-2020-1956 Apache Kylin OS Command Injection

What is CVE-2020-1956?

CVE-2020-1956 is a high-severity command injection vulnerability in Apache Kylin, published on 22 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Weakness: CWE-78

Which versions are affected by CVE-2020-1956?

4 open source packages ship an affected version, including org.apache.kylin:kylin-core-common. It affects 1 product.

Products include Apache Kylin.

How do I fix CVE-2020-1956?

Upgrade org.apache.kylin:kylin-core-common to a fixed version for your release line: 2.6.6 or 3.0.2. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-1956 being exploited?

Yes. Attackers have exploited CVE-2020-1956 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Apache Kylin

• CVE-2026-62390 Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API Critical 9.8
• CVE-2022-44621 Apache Kylin: Command injection by Diagnosis Controller Critical 9.8
• CVE-2022-24697 Apache Kylin vulnerable to remote code execution Critical 9.8
• CVE-2021-31522 Apache Kylin unsafe class loading Critical 9.8
• CVE-2021-45456 Command injection Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gprm-xqrc-c2j3.