Apache Kylin: Insufficiently protected credentials in config file

CVE-2023-29055

Summary

In certain versions of Apache Kylin, a vulnerability exists within the Server Config web interface that inadvertently exposes the contents of the 'kylin.properties' file. This file may contain sensitive information such as server-side credentials, which can be compromised if the Kylin service runs over HTTP or other unencrypted protocols. Network attackers can utilize packet sniffing techniques to intercept the transmitted payload, leading to unauthorized access to sensitive configuration data. To mitigate this risk, it is crucial to enforce HTTPS for encrypted communication, refrain from storing credentials in 'kylin.properties' in plaintext, implement robust network firewalls to restrict access to internal servers, and upgrade to Apache Kylin 4.0.4 or later to ensure that sensitive information is properly filtered from the web interface.

References