Vulnerabilidad de Falsificación de Solicitud del Lado del Servidor (SSRF) en Apache Kylin a través del Endpoint `/kylin/api/xxx/diag`

The SSRF vulnerability in Apache Kylin allows an attacker with administrative privileges to craft malicious requests. By exploiting this flaw, an attacker can potentially trigger requests to internal services or hosts that are not directly accessible from the outside world. This could lead to information disclosure, as the attacker might be able to access sensitive data exposed through the /kylin/api/xxx/diag endpoint on internal systems. The potential blast radius is limited to internal resources accessible from the Kylin server, but the impact can be significant if those resources contain sensitive data.

Organizations running Apache Kylin versions 5.0.0 and prior, particularly those with internal services accessible from the Kylin server, are at risk. Shared hosting environments where multiple users share a Kylin instance are also vulnerable, as an attacker could potentially exploit the vulnerability through a compromised user account.

• java / server: Monitor Kylin server logs for unusual outbound requests, particularly those targeting internal hosts or the /kylin/api/xxx/diag endpoint. Use network monitoring tools to detect suspicious connections originating from the Kylin server.

grep -i '/kylin/api/xxx/diag' /var/log/kylin/kylin.log

• java / supply-chain: Examine dependencies for known vulnerabilities that could be chained with this SSRF vulnerability. • generic web: Check for exposed internal services reachable from the Kylin server using tools like nmap or curl to identify potential targets for SSRF attacks.

1. 2025-03-27Disclosure

   disclosure

1. Reservado2024-10-09
2. Publicada2025-03-27
3. EPSS actualizado2026-04-02

The primary mitigation for CVE-2024-48944 is to upgrade Apache Kylin to version 5.0.2 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, consider restricting network access to the Kylin server to prevent it from reaching internal resources. Implement strict firewall rules to limit outbound connections from the Kylin server. Additionally, review and secure any internal services exposed through the /kylin/api/xxx/diag endpoint to minimize potential data leakage. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability and verifying that the request is blocked.