CVE-2025-66518
📋 TL;DR
This vulnerability allows clients accessing Apache Kyuubi Server to bypass the server-side configuration that restricts which local directories can be accessed. Attackers can read arbitrary local files not included in the allow list. This affects all Apache Kyuubi deployments from version 1.6.0 through 1.10.2.
💻 Affected Systems
- Apache Kyuubi
📦 What is this software?
Kyuubi by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through sensitive file disclosure (credentials, configuration files, private keys) leading to data exfiltration, privilege escalation, or lateral movement.
Likely Case
Unauthorized access to sensitive local files containing configuration data, credentials, or proprietary information stored on the Kyuubi server.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized clients from reaching the Kyuubi frontend protocols.
🎯 Exploit Status
The vulnerability description suggests any client with access to Kyuubi frontend protocols can exploit this without authentication, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.3 or higher
Vendor Advisory: https://lists.apache.org/thread/xp460bwbyzdhho34ljd4nchyt2fmhodl
Restart Required: Yes
Instructions:
1. Download Apache Kyuubi version 1.10.3 or higher from the official Apache website. 2. Stop the Kyuubi service. 3. Replace the existing installation with the patched version. 4. Restart the Kyuubi service. 5. Verify the service is running correctly.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to Kyuubi frontend protocols to only trusted clients using firewall rules or network security groups.
# Example iptables rule to restrict access to Kyuubi port (default 10009)
iptables -A INPUT -p tcp --dport 10009 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 10009 -j DROP
File System Hardening
linuxApply strict file system permissions to limit what files the Kyuubi process user can access, reducing potential impact.
# Set restrictive permissions on sensitive directories
chmod 700 /etc/kyuubi
chmod 600 /etc/kyuubi/*.conf
# Run Kyuubi under a dedicated non-privileged user
useradd -r -s /bin/false kyuubi_user
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Kyuubi servers from untrusted networks and clients.
- Apply additional file system access controls and audit sensitive file access patterns on the Kyuubi server.
🔍 How to Verify
Check if Vulnerable:
Check the Kyuubi server version. If it's between 1.6.0 and 1.10.2 inclusive, the system is vulnerable.Check Version:
./bin/kyuubi version # Run from Kyuubi installation directoryVerify Fix Applied:
After upgrading, verify the version is 1.10.3 or higher and test that the kyuubi.session.local.dir.allow.list configuration properly restricts file access.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Kyuubi logs
- Access attempts to files outside the configured allow list
- Errors related to file permission violations
Network Indicators:
- Unexpected client connections to Kyuubi frontend protocols
- Traffic patterns indicating file enumeration attempts
SIEM Query:
source="kyuubi.log" AND ("FileNotFoundException" OR "Permission denied" OR "access denied") AND NOT path IN allowed_paths