CVE-2021-27738 Improper Access Control to Streaming Coordinator & SSRF

What is CVE-2021-27738?

CVE-2021-27738 is a high-severity missing authorization vulnerability in Apache Kylin, published on 6 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.

Weakness: CWE-918

Which versions are affected by CVE-2021-27738?

2 open source packages ship an affected version, including org.apache.kylin:kylin. It affects 1 product.

Products include Apache Kylin.

How do I fix CVE-2021-27738?

Upgrade org.apache.kylin:kylin to 3.1.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-27738 being exploited?

There is no known exploitation of CVE-2021-27738 in the wild and no public exploit code.

Other vulnerabilities in Apache Kylin

• CVE-2020-1956 Apache Kylin OS Command Injection Exploited High 8.8
• CVE-2026-62390 Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API Critical 9.8
• CVE-2022-44621 Apache Kylin: Command injection by Diagnosis Controller Critical 9.8
• CVE-2022-24697 Apache Kylin vulnerable to remote code execution Critical 9.8
• CVE-2021-31522 Apache Kylin unsafe class loading Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wrx7-qgmj-mf2q.