Path-Confinement Bypass in Apache Kylin During Metadata Backup Deletion

Executive Summary

This vulnerability is a path-confinement bypass during metadata backup deletion in Apache Kylin. It allows unauthorized access to delete metadata backups outside intended directories, potentially affecting exposed Kylin services.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking Apache Kylin versions between 4.0.0 and 5.0.4. Use commands like 'kylin.sh version' or check package managers (e.g., 'rpm -qa | grep kylin' or 'dpkg -l | grep kylin'). Verify if exposed to public networks via network scans or firewall logs.

Useful 0 Not Useful 0

Impact Analysis

Mostly impacts Kylin services directly exposed to public networks. In-house deployments are generally not affected. Exploitation could lead to unauthorized deletion of metadata backups.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability's impact on compliance with standards like GDPR or HIPAA is not explicitly addressed in the provided context. The issue involves a path-confinement bypass during metadata backup deletion in Apache Kylin, which primarily affects exposed services. Without direct exposure, the risk to compliance is likely minimal.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Apache Kylin to version 5.0.5 or later to fix the path-confinement bypass issue.
• Check if your Kylin service is exposed to a public network. If so, restrict access or upgrade immediately.
• Verify your current Kylin version. If it is between 4.0.0 and 5.0.4, plan an upgrade as soon as possible.

Useful 0 Not Useful 0