Listen to this Post
The CVE-2025-61735 vulnerability in Apache Kylin is a Server-Side Request Forgery (SSRF) flaw present in versions 4.0.0 through 5.0.2. The vulnerability exists within components that handle external requests, specifically where user-supplied input is insufficiently validated before being used to initiate HTTP requests from the Kylin server. An attacker with system or project admin privileges can exploit this by crafting a malicious request that forces the Kylin server to send an HTTP request to an arbitrary internal or external system. This could allow the attacker to access sensitive internal services that are otherwise protected from direct external access, potentially leading to information disclosure or further network enumeration. The attack is contingent on the attacker already having compromised admin-level credentials, as noted in the advisory.
Platform: Apache Kylin
Version: 4.0.0 – 5.0.2
Vulnerability : Server-Side Request Forgery
Severity: High
date: 2025-10-02
Prediction: 2025-10-16
What Undercode Say:
curl -X POST http://<kylin-server>:7070/kylin/api/... \
-H 'Authorization: Basic ...' \
-H 'Content-Type: application/json' \
-d '{"url":"http://169.254.169.254/latest/meta-data/"}'
// Example vulnerable code pattern (conceptual)
String userControlledUrl = request.getParameter("url");
URL url = new URL(userControlledUrl);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
// Makes request without whitelist validation
How Exploit:
Abuse admin privileges.
Craft malicious SSRF payload.
Target internal metadata services.
Scan internal network segments.
Protection from this CVE
Upgrade to v5.0.3.
Restrict admin access.
Implement network segmentation.
Use request whitelisting.
Impact:
Internal service access.
Metadata exposure.
Potential data breach.
Network reconnaissance.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
