Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint

The primary impact of this SSRF vulnerability lies in the potential for information disclosure. An attacker, possessing administrative privileges within the Kylin environment, can leverage the /kylin/api/xxx/diag endpoint to craft malicious requests targeting other internal services. If these internal services expose sensitive data or functionalities, the attacker could potentially gain unauthorized access to that information. The blast radius is limited to the internal network accessible from the Kylin server, but the consequences could be significant depending on the sensitivity of the targeted internal resources. This vulnerability shares similarities with other SSRF exploits where attackers leverage internal network access to probe and potentially compromise other systems.

Organizations running Apache Kylin versions 5.0.0 and prior, particularly those with internal services accessible from the Kylin server, are at risk. Shared hosting environments where multiple users share a Kylin instance are also vulnerable, as an attacker could potentially exploit the vulnerability through a compromised user account.

• java / server: Monitor Kylin server logs for unusual outbound requests, particularly those targeting internal hosts or the /kylin/api/xxx/diag endpoint. Use network monitoring tools to detect suspicious connections originating from the Kylin server.

grep -i '/kylin/api/xxx/diag' /var/log/kylin/kylin.log

• java / supply-chain: Examine dependencies for known vulnerabilities that could be chained with this SSRF vulnerability. • generic web: Check for exposed internal services reachable from the Kylin server using tools like nmap or curl to identify potential targets for SSRF attacks.

1. 2025-03-27Disclosure

   disclosure

1. Reserviert2024-10-09
2. Veröffentlicht2025-03-27
3. EPSS aktualisiert2026-04-02

The recommended mitigation for CVE-2024-48944 is to immediately upgrade Apache Kylin to version 5.0.2 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access from the Kylin server to only necessary internal hosts. Implement strict firewall rules to block outbound traffic to unauthorized destinations. Monitor the /kylin/api/xxx/diag endpoint for suspicious activity. While a WAF might offer some protection, it is not a substitute for patching the underlying vulnerability. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability and verifying that the request is blocked.