CVE-2020-1956

CVE-2020-1956 is an OS command injection flaw (CWE-78) in certain RESTful APIs of Apache Kylin, which concatenate user-supplied input into OS commands without any protection or validation. An authenticated user with low privileges can send crafted input to an affected API endpoint, causing arbitrary OS commands to execute on the Kylin server with the service account's privileges, yielding full read/write control of the host (confidentiality, integrity, and availability all rated high). Organizations running Apache Kylin releases from 2.3.0 up to and including 2.6.5, and releases up to 3.0.1, are affected. Exploitation is well established: a public proof of concept exists (SonarSource), EPSS puts the 30-day exploitation probability at 97.3% (100th percentile), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-03-25, indicating confirmed in-the-wild exploitation.

What to do: Upgrade Apache Kylin to a release later than 2.6.5/3.0.1 per vendor instructions, as patching is the required action under CISA's KEV listing. Until patched, restrict network access to Kylin's REST API endpoints to trusted networks and users, since exploitation requires credentials. Check Kylin hosts for signs of unexpected command execution, as the flaw is known to be exploited in the wild.