Apache Kylin Code Injection Vulnerability Allowing Remote Code Execution via JDBC Connection

A code injection vulnerability has been identified in Apache Kylin versions 4.0.0 prior to 5.0.1. This vulnerability allows an attacker with system or project admin permissions to modify the JDBC connection settings, potentially executing arbitrary code from a remote source. The issue underscores the importance of safeguarding admin access in Kylin.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the server where Apache Kylin is running.

Remediation

Users are advised to upgrade to Apache Kylin version 5.0.2 or later, which addresses this vulnerability.