Improper Access Control to Streaming Coordinator & SSRF
Vulnerability Description
All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-27738
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Wei Lin Ngo <ngo.weilin@starlabs.sg>
References
More from Apache Software Foundation
View All →Affected Vendor
Apache Software Foundation
View all reports →