AI analysis
Apache Kylin 5 through 5.0.4 has a missing-authentication flaw on certain backend cache API endpoints that can lead to SQL injection. An unauthenticated attacker who can reach those endpoints can submit specially crafted input that is executed as SQL. The practical impact is highest for Kylin services exposed directly to the public network, which Apache says is not common; typical in-house deployments are mostly not affected. The issue is fixed in version 5.0.5. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.
What to do: Upgrade Apache Kylin to 5.0.5. Until then, do not expose Kylin services to the public internet and restrict the backend cache APIs to trusted networks and authenticated callers only. Review access logs for unauthenticated requests to those cache endpoints.
Affected
| Apache Kylin | 5 through 5.0.4 |
Estimated exposure
nicheunknown (public exposure described as uncommon) — Apache states that direct public-network exposure of Kylin is uncommon and that typical in-house deployments are mostly not impacted; no public install or scan counts are available.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.