cnvd - cnvd-2022-02490

CNVD-2022-02490

Vulnerability from cnvd - Published: 2022-01-11

Title

Apache Kylin访问控制错误漏洞

Description

Apache Kylin是美国阿帕奇（Apache）基金会的一款开源的分布式分析型数据仓库。该产品主要提供Hadoop/Spark之上的SQL查询接口及多维分析（OLAP）等功能。 Apache kylin存在访问控制错误漏洞，该漏洞源于在Apache Kylin中，允许从任何来源发送带有凭据的跨来源请求。目前没有详细的漏洞细节提供。

Severity

中

Patch Name

Apache Kylin访问控制错误漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-45457

Impacted products

Name
['Apache Kylin 2.0.0', 'Apache Kylin 2.1.0', 'Apache Kylin 2.2.0', 'Apache Kylin 2.3.0', 'Apache Kylin 2.3.1', 'Apache Kylin 2.3.2', 'Apache Kylin 2.4.0', 'Apache Kylin 2.4.1', 'Apache Kylin 2.5.0', 'Apache Kylin 2.5.1', 'Apache Kylin 2.5.2', 'Apache Kylin 2.6.1', 'Apache Kylin 2.6.2', 'Apache Kylin 2.6.3', 'Apache Kylin 2.6.4', 'Apache Kylin 2.6.5', 'Apache Kylin 2.6.6', 'Apache Kylin 3.0.0', 'Apache Kylin 3.0.1', 'Apache Kylin 3.0.2', 'Apache Kylin 3.1.0', 'Apache Kylin 3.1.1', 'Apache Kylin 3.1.2', 'Apache Kylin 4.0.0']

Name

['Apache Kylin 2.0.0', 'Apache Kylin 2.1.0', 'Apache Kylin 2.2.0', 'Apache Kylin 2.3.0', 'Apache Kylin 2.3.1', 'Apache Kylin 2.3.2', 'Apache Kylin 2.4.0', 'Apache Kylin 2.4.1', 'Apache Kylin 2.5.0', 'Apache Kylin 2.5.1', 'Apache Kylin 2.5.2', 'Apache Kylin 2.6.1', 'Apache Kylin 2.6.2', 'Apache Kylin 2.6.3', 'Apache Kylin 2.6.4', 'Apache Kylin 2.6.5', 'Apache Kylin 2.6.6', 'Apache Kylin 3.0.0', 'Apache Kylin 3.0.1', 'Apache Kylin 3.0.2', 'Apache Kylin 3.1.0', 'Apache Kylin 3.1.1', 'Apache Kylin 3.1.2', 'Apache Kylin 4.0.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-45457"
    }
  },
  "description": "Apache Kylin\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u5206\u5e03\u5f0f\u5206\u6790\u578b\u6570\u636e\u4ed3\u5e93\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u63d0\u4f9bHadoop/Spark\u4e4b\u4e0a\u7684SQL\u67e5\u8be2\u63a5\u53e3\u53ca\u591a\u7ef4\u5206\u6790\uff08OLAP\uff09\u7b49\u529f\u80fd\u3002\n\nApache kylin\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728Apache Kylin\u4e2d\uff0c\u5141\u8bb8\u4ece\u4efb\u4f55\u6765\u6e90\u53d1\u9001\u5e26\u6709\u51ed\u636e\u7684\u8de8\u6765\u6e90\u8bf7\u6c42\u3002 \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-02490",
  "openTime": "2022-01-11",
  "patchDescription": "Apache Kylin\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u6b3e\u5f00\u6e90\u7684\u5206\u5e03\u5f0f\u5206\u6790\u578b\u6570\u636e\u4ed3\u5e93\u3002\u8be5\u4ea7\u54c1\u4e3b\u8981\u63d0\u4f9bHadoop/Spark\u4e4b\u4e0a\u7684SQL\u67e5\u8be2\u63a5\u53e3\u53ca\u591a\u7ef4\u5206\u6790\uff08OLAP\uff09\u7b49\u529f\u80fd\u3002\r\n\r\nApache kylin\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728Apache Kylin\u4e2d\uff0c\u5141\u8bb8\u4ece\u4efb\u4f55\u6765\u6e90\u53d1\u9001\u5e26\u6709\u51ed\u636e\u7684\u8de8\u6765\u6e90\u8bf7\u6c42\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Kylin\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apache Kylin 2.0.0",
      "Apache Kylin 2.1.0",
      "Apache Kylin 2.2.0",
      "Apache Kylin 2.3.0",
      "Apache Kylin 2.3.1",
      "Apache Kylin 2.3.2",
      "Apache Kylin 2.4.0",
      "Apache Kylin 2.4.1",
      "Apache Kylin 2.5.0",
      "Apache Kylin 2.5.1",
      "Apache Kylin 2.5.2",
      "Apache Kylin 2.6.1",
      "Apache Kylin 2.6.2",
      "Apache Kylin 2.6.3",
      "Apache Kylin 2.6.4",
      "Apache Kylin 2.6.5",
      "Apache Kylin 2.6.6",
      "Apache Kylin 3.0.0",
      "Apache Kylin 3.0.1",
      "Apache Kylin 3.0.2",
      "Apache Kylin 3.1.0",
      "Apache Kylin 3.1.1",
      "Apache Kylin 3.1.2",
      "Apache Kylin 4.0.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-45457",
  "serverity": "\u4e2d",
  "submitTime": "2022-01-07",
  "title": "Apache Kylin\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2021-45457 (GCVE-0-2021-45457)

Vulnerability from cvelistv5 – Published: 2022-01-06 12:35 – Updated: 2024-08-04 04:39

Title

Overly broad CORS configuration

Summary

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

Severity ?

No CVSS data available.

CWE

CORS

Assigner

apache

References

URL

Tags

	https://lists.apache.org/thread/rzv4mq58okwj1n88l…	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2022/01/06/2	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Kylin	Affected: Apache Kylin 2 , ≤ 2.6.6 (custom) Affected: Apache Kylin 3 , ≤ 3.1.2 (custom) Affected: Apache Kylin 4 , ≤ 4.0.0 (custom)

Credits

Alvaro Munoz <pwntester@github.com>

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:39:21.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m"
          },
          {
            "name": "[oss-security] 20220106 CVE-2021-45457: Apache Kylin: Overly broad CORS configuration",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/01/06/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Kylin",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.6.6",
              "status": "affected",
              "version": "Apache Kylin 2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "3.1.2",
              "status": "affected",
              "version": "Apache Kylin 3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "Apache Kylin 4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alvaro Munoz \u003cpwntester@github.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CORS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-06T15:06:14",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m"
        },
        {
          "name": "[oss-security] 20220106 CVE-2021-45457: Apache Kylin: Overly broad CORS configuration",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/01/06/2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Overly broad CORS configuration ",
      "workarounds": [
        {
          "lang": "en",
          "value": "\nKylin reflects the `Origin` header and allow credentials to be sent cross-origin in the default configuration. The preflight OPTIONS request:\n```\nOPTIONS /kylin/api/projects HTTP/1.1\nHost: localhost:7070\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0\nAccept: */*\nAccept-Language: en-US\nAccept-Encoding: gzip, deflate\nAccess-Control-Request-Method: POST\nAccess-Control-Request-Headers: content-type\nReferer: http://b49b-95-62-58-48.ngrok.io/\nOrigin: http://b49b-95-62-58-48.ngrok.io\nConnection: keep-alive\nCache-Control: max-age=0\n```\n\nWill be replied with:\n\n```\nHTTP/1.1 200 OK\nServer: Apache-Coyote/1.1\nAccess-Control-Allow-Origin: http://b49b-95-62-58-48.ngrok.io\nAccess-Control-Allow-Credentials: true\nVary: Origin\nAccess-Control-Allow-Methods: DELETE, POST, GET, OPTIONS, PUT\nAccess-Control-Allow-Headers: Authorization, Origin, No-Cache, X-Requested-With, Cache-Control, Accept, X-E4m-With, If-Modified-Since, Pragma, Last-Modified, Expires, Content-Type\nContent-Length: 0\n```\n\nUsers of Kylin 2.x \u0026 Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1782.\nUsers of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1781."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-45457",
          "STATE": "PUBLIC",
          "TITLE": "Overly broad CORS configuration "
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Kylin",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kylin 2",
                            "version_value": "2.6.6"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kylin 3",
                            "version_value": "3.1.2"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_name": "Apache Kylin 4",
                            "version_value": "4.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Alvaro Munoz \u003cpwntester@github.com\u003e"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "moderate"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CORS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m"
            },
            {
              "name": "[oss-security] 20220106 CVE-2021-45457: Apache Kylin: Overly broad CORS configuration",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/01/06/2"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "\nKylin reflects the `Origin` header and allow credentials to be sent cross-origin in the default configuration. The preflight OPTIONS request:\n```\nOPTIONS /kylin/api/projects HTTP/1.1\nHost: localhost:7070\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0\nAccept: */*\nAccept-Language: en-US\nAccept-Encoding: gzip, deflate\nAccess-Control-Request-Method: POST\nAccess-Control-Request-Headers: content-type\nReferer: http://b49b-95-62-58-48.ngrok.io/\nOrigin: http://b49b-95-62-58-48.ngrok.io\nConnection: keep-alive\nCache-Control: max-age=0\n```\n\nWill be replied with:\n\n```\nHTTP/1.1 200 OK\nServer: Apache-Coyote/1.1\nAccess-Control-Allow-Origin: http://b49b-95-62-58-48.ngrok.io\nAccess-Control-Allow-Credentials: true\nVary: Origin\nAccess-Control-Allow-Methods: DELETE, POST, GET, OPTIONS, PUT\nAccess-Control-Allow-Headers: Authorization, Origin, No-Cache, X-Requested-With, Cache-Control, Accept, X-E4m-With, If-Modified-Since, Pragma, Last-Modified, Expires, Content-Type\nContent-Length: 0\n```\n\nUsers of Kylin 2.x \u0026 Kylin 3.x should upgrade to 3.1.3 or apply patch https://github.com/apache/kylin/pull/1782.\nUsers of Kylin 4.x should upgrade to 4.0.1 or apply patch https://github.com/apache/kylin/pull/1781."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-45457",
    "datePublished": "2022-01-06T12:35:22",
    "dateReserved": "2021-12-21T00:00:00",
    "dateUpdated": "2024-08-04T04:39:21.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2022-02490

CVE-2021-45457 (GCVE-0-2021-45457)

Tags

Sightings

Nomenclature