Vulnérabilité Server-Side Request Forgery (SSRF) dans Apache Kylin

The SSRF vulnerability in Apache Kylin allows an attacker to craft malicious requests that the Kylin server will execute. This could lead to the exposure of sensitive internal resources, such as metadata databases or internal APIs. An attacker could potentially scan internal networks, access cloud credentials stored within the Kylin environment, or even trigger actions on other internal systems if they are accessible via HTTP/HTTPS. The blast radius is limited by the network segmentation and access controls in place within the affected environment; however, a successful exploitation could lead to significant data breaches and system compromise.

Organizations deploying Apache Kylin for big data analytics, particularly those with internal network access from the Kylin server, are at risk. Environments with weak access controls to the Kylin system and project admin interfaces are especially vulnerable. Shared hosting environments running Kylin should be considered high-risk.

• java / server:

ps aux | grep kylin

• java / server:

journalctl -u kylin | grep -i "server-side request forgery"

• generic web:

curl -I http://<kylin_server>/internal_resource

• generic web:

 grep -r "http://internal.host" /opt/kylin/conf/*

1. 2025-10-02Disclosure

   disclosure

1. Réservé2025-09-30
2. Publiée2025-10-02
3. Modifiée2025-11-05
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-61735 is to upgrade Apache Kylin to version 5.0.3 or later. If an immediate upgrade is not feasible, restrict access to the Kylin system and project admin interfaces to trusted users only. Implement strict network segmentation to limit the potential impact of a successful SSRF attack. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter out malicious requests. Regularly review and update Kylin's configuration to ensure it adheres to security best practices. After upgrade, confirm the fix by attempting a crafted SSRF request and verifying it is blocked.