Apache Kylin CubeService.java 命令注入漏洞 CVE-2020-1956¶

docker pull apachekylin/apache-kylin-standalone:3.0.1

docker run -d \
-m 8G \
-p 7070:7070 \
-p 8088:8088 \
-p 50070:50070 \
-p 8032:8032 \
-p 8042:8042 \
-p 16010:16010 \
apachekylin/apache-kylin-standalone:3.0.1

POST /kylin/api/cubes/{cube}/{project}/migrate

apache-kylin-3.0.1\server-base\src\main\java\org\apache\kylin\rest\service\CubeService.java

    for (CubeSegment segment : cube.getSegments()) {
        if (segment.getStatus() != SegmentStatusEnum.READY) {
            throw new InternalErrorException(
                    "At least one segment is not in READY state. Please check whether there are Running or Error jobs.");
        }
    }

    String srcCfgUri = config.getAutoMigrateCubeSrcConfig();
    String dstCfgUri = config.getAutoMigrateCubeDestConfig();

    Preconditions.checkArgument(StringUtils.isNotEmpty(srcCfgUri), "Source configuration should not be empty.");
    Preconditions.checkArgument(StringUtils.isNotEmpty(dstCfgUri), "Destination configuration should not be empty.");

    String stringBuilderstringBuilder = ("%s/bin/kylin.sh org.apache.kylin.tool.CubeMigrationCLI %s %s %s %s %s %s true true");
    String cmd = String.format(Locale.ROOT, stringBuilder, KylinConfig.getKylinHome(), srcCfgUri, dstCfgUri,
            cube.getName(), projectName, config.isAutoMigrateCubeCopyAcl(), config.isAutoMigrateCubePurge());

    logger.info("One click migration cmd: " + cmd);

    CliCommandExecutor exec = new CliCommandExecutor();
    PatternedLogger patternedLogger = new PatternedLogger(logger);

    try {
        exec.execute(cmd, patternedLogger);
    } catch (IOException e) {
        throw new InternalErrorException("Failed to perform one-click migrating", e);
    }
}

在没有开启配置`kylin.tool.auto-migrate-cube.enabled`为`true`的情况下，调用`MigrateCube`则会出现报错

![image-20210629155426528](/assets/PeiQi-Wiki/img/image-20210629155426528.png)

通过`Apache Kylin`的`SYSTEM模块`开启`kylin.tool.auto-migrate-cube.enabled`为`True`

![kylin-8](/assets/PeiQi-Wiki/img/kylin-8.png)

![kylin-9](/assets/PeiQi-Wiki/img/kylin-9.png)

设置后再去请求则不会出现刚刚的报错，而是出现`Source configuration should not be empty`

![kylin-10](/assets/PeiQi-Wiki/img/kylin-10.png)

跟进出现报错的代码块

```java {4-5}
String srcCfgUri = config.getAutoMigrateCubeSrcConfig();
        String dstCfgUri = config.getAutoMigrateCubeDestConfig();

        Preconditions.checkArgument(StringUtils.isNotEmpty(srcCfgUri), "Source configuration should not be empty.");
        Preconditions.checkArgument(StringUtils.isNotEmpty(dstCfgUri),
                "Destination configuration should not be empty.");

public String getAutoMigrateCubeDestConfig() {

    return getOptional("kylin.tool.auto-migrate-cube.dest-config", "");
}

    SSHClientOutput sshOutput;
    try {
        sshOutput = ssh.execCommand(command, remoteTimeoutSeconds, logAppender);
        int exitCode = sshOutput.getExitCode();
        String output = sshOutput.getText();
        return Pair.newPair(exitCode, output);
    } catch (IOException e) {
        throw e;
    } catch (Exception e) {
        throw new IOException(e.getMessage(), e);
    }
}

private Pair<Integer, String> runNativeCommand(String command, Logger logAppender) throws IOException {
    String[] cmd = new String[3];
    String osName = System.getProperty("os.name");
    if (osName.startsWith("Windows")) {
        cmd[0] = "cmd.exe";
        cmd[1] = "/C";
    } else {
        cmd[0] = "/bin/bash";
        cmd[1] = "-c";
    }
    cmd[2] = command;

    ProcessBuilder builder = new ProcessBuilder(cmd);
    builder.redirectErrorStream(true);
    Process proc = builder.start();

    BufferedReader reader = new BufferedReader(
            new InputStreamReader(proc.getInputStream(), StandardCharsets.UTF_8));
    String line;
    StringBuilder result = new StringBuilder();
    while ((line = reader.readLine()) != null && !Thread.currentThread().isInterrupted()) {
        result.append(line).append('\n');
        if (logAppender != null) {
            logAppender.log(line);
        }
    }

    if (Thread.interrupted()) {
        logger.info("CliCommandExecutor is interruppted by other, kill the sub process: " + command);
        proc.destroy();
        try {
            Thread.sleep(1000);
        } catch (InterruptedException e) {
            // do nothing
        }
        return Pair.newPair(1, "Killed");
    }

    try {
        int exitCode = proc.waitFor();
        return Pair.newPair(exitCode, result.toString());
    } catch (InterruptedException e) {
        Thread.currentThread().interrupt();
        throw new IOException(e);
    }
}

由此可以得出我们可以通过这两个可控的参数，执行任意我们需要的命令，例如反弹一个shell，设置的配置为