Apache Kylin up to 4.0.3 Server Config Web Interface kylin.properties cleartext transmission

Summaryinfo

A vulnerability, which was classified as problematic, was found in Apache Kylin up to 4.0.3. Affected by this vulnerability is an unknown functionality of the component Server Config Web Interface. Such manipulation of the argument kylin.properties leads to cleartext transmission. This vulnerability is documented as CVE-2023-29055. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Kylin up to 4.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Server Config Web Interface. The manipulation of the argument kylin.properties with an unknown input leads to a cleartext transmission vulnerability. Using CWE to declare the problem leads to CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Impacted is confidentiality. CVE summarizes:

In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials. To avoid this threat, users are recommended to  * Always turn on HTTPS so that network payload is encrypted. * Avoid putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect the serverside such that it is not accessible to external attackers. * Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.

The weakness was released 01/29/2024. The advisory is shared for download at lists.apache.org. This vulnerability is handled as CVE-2023-29055 since 03/30/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1040.

Upgrading to version 4.0.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-0235). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Apache

Name

• Kylin

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion