CVE-2020-13925

published 2020-07-14

CVE-2020-13925: Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the…

Priority P2 70 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
apache	kylin	>= 2.3.0 < 3.1.0	3.1.0

Detection & IOCs extracted from sources · hover to see the quote

path /kylin/api/diag/project/%7c%7c

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Apache Kylin REST API DiagnosisService Command Injection Inbound (CVE-2020-13925)"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:"/kylin/api/diag/project/%7c%7c"; reference:url,github.com/bit4woo/CVE-2020-13925; reference:cve,2020-13925; classtype:attempted-admin; sid:2033404; rev:1; metadata:created_at 2021_07_24, cve CVE_2020_13925, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_24, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;)

• → Look for HTTP GET requests to the Apache Kylin DiagnosisService REST API endpoint containing URL-encoded pipe characters (%7c%7c) in the project path parameter, indicating OS command injection via pipe chaining.
• → The vulnerability involves the Kylin REST API concatenating user-supplied inputs directly into OS commands without input validation, enabling remote OS command execution.
• → Monitor for HTTP GET method used against Kylin API endpoints — the attack vector is inbound GET requests to the DiagnosisService endpoint.

• · The Snort/ET rule for CVE-2020-13925 (sid:2033404) is specifically scoped to the DiagnosisService endpoint. A separate ET rule (sid:2033405) references CVE-2019-0230 (Apache Struts OGNL RCE) but cites the same PoC repository (github.com/bit4woo/CVE-2020-13925) — ensure rules are not conflated; they target different vulnerabilities and products.
• · Affected versions are Apache Kylin versions after 2.3 up to (not including) 3.1.0. Only deployments running those versions are at risk.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

ghsa 8.8 HIGH

osv 8.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78