CVE-2021-27738
📋 TL;DR
This vulnerability allows unauthenticated attackers to manipulate Apache Kylin's streaming cube management and replica sets via unprotected REST API endpoints. Attackers can perform administrative actions like assigning/unassigning streaming cubes and modifying replica sets, with limited SSRF capabilities. This affects Apache Kylin 3 installations prior to version 3.1.2.
💻 Affected Systems
- Apache Kylin
📦 What is this software?
Kylin by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Kylin streaming infrastructure, unauthorized data manipulation, and limited server-side request forgery to internal systems.
Likely Case
Unauthorized administrative actions on streaming cubes and replica sets, potentially disrupting data processing pipelines.
If Mitigated
No impact if proper authentication and authorization controls are implemented.
🎯 Exploit Status
Simple HTTP requests to unprotected endpoints, no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache Kylin 3.1.2 or later
Vendor Advisory: https://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70
Restart Required: Yes
Instructions:
1. Backup current Kylin installation. 2. Download Kylin 3.1.2 or later from Apache website. 3. Stop Kylin service. 4. Replace with patched version. 5. Restart Kylin service. 6. Verify functionality.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to Kylin Coordinator endpoints using firewall rules or network segmentation.
iptables -A INPUT -p tcp --dport [kylin-port] -s [trusted-ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [kylin-port] -j DROP
Reverse Proxy Authentication
allPlace Kylin behind a reverse proxy with authentication requirements.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Kylin from untrusted networks
- Deploy web application firewall (WAF) with rules blocking unauthorized API calls to affected endpoints
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated HTTP requests to /kylin/api/streaming_coordinator/* endpoints are accepted.Check Version:
Check Kylin version in web interface or configuration files, or run: curl http://[kylin-host]:[port]/kylin/api/aboutVerify Fix Applied:
Verify that unauthenticated requests to affected endpoints return authentication errors (401/403).📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to /kylin/api/streaming_coordinator/* endpoints
- Unexpected cube assignment/unassignment events
- Replica set modifications from unknown sources
Network Indicators:
- HTTP POST/PUT/DELETE requests to streaming coordinator endpoints without authentication headers
- Unusual traffic patterns to Kylin Coordinator API
SIEM Query:
source="kylin.log" AND (uri="/kylin/api/streaming_coordinator/*" AND NOT (user!="anonymous" OR auth_success="true"))