Listen to this Post
The CVE-2024-33401 vulnerability in Apache Kylin stems from an improper access control mechanism within the application’s file-serving endpoints. Specifically, certain HTTP endpoints designed to serve static resources or exported files do not correctly validate a user’s authorization level for the requested project or system resource. An attacker can exploit this by crafting a direct request to these endpoints with a valid, low-privilege user session. This allows them to bypass project-level authorization checks and directly access sensitive files. These files could include exported project metadata, configuration files, or other artifacts that should be restricted to project administrators. The core failure is that the endpoint checks for authentication but does not enforce the necessary project-specific role-based authorization, making any authenticated user a potential threat.
Platform: Apache Kylin
Version: 4.0.0-5.0.2
Vulnerability : Improper Access Control
Severity: Critical
date: 2024
Prediction: Patch Available
What Undercode Say:
curl -H "Cookie: JSESSIONID=USER_SESSION" http://kylin-server/kylin/api/files/export?file=../conf/kylin.properties
nmap -p 7070 kylin-server --script http-vuln-cve2024-33401
How Exploit:
Crafting URL paths to traverse directories and access sensitive files using an authenticated session.
Protection from this CVE
Upgrade to Kylin 5.0.3. Enforce strict principle of least privilege for all user accounts. Implement network segmentation to restrict access to Kylin instances.
Impact:
Unauthorized access to sensitive configuration and project data, leading to potential full system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
