Kyuubi
Monthly
Arbitrary file write in Apache Kyuubi (1.7.0 through 1.11.1) lets a remote attacker abuse the REST batch multipart upload endpoint, which trusts the client-supplied filename, to plant controlled content anywhere the server process can write. Because the server never sanitizes path traversal sequences (../) in the multipart filename, an attacker can escape the intended upload directory and overwrite or create files subject only to filesystem permissions. EPSS is low (0.28%, 21st percentile) and there is no public exploit identified at time of analysis, but the primitive is powerful and the fix is available in 1.12.0.
Server-Side Request Forgery (SSRF) and open-proxy behavior in Apache Kyuubi's Engine UI proxy exposes the Kyuubi server as a request forwarder to arbitrary internal or external hosts. Versions 1.8.0 through 1.11.x accept an attacker-controlled host and port from the HTTP request path and blindly proxy the request to that destination, enabling network pivoting into otherwise unreachable services behind the Kyuubi server. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the unauthenticated network vector and trivial exploitation conditions make this a credible internal reconnaissance risk in exposed deployments.
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. [CVSS 8.8 HIGH]
Arbitrary file write in Apache Kyuubi (1.7.0 through 1.11.1) lets a remote attacker abuse the REST batch multipart upload endpoint, which trusts the client-supplied filename, to plant controlled content anywhere the server process can write. Because the server never sanitizes path traversal sequences (../) in the multipart filename, an attacker can escape the intended upload directory and overwrite or create files subject only to filesystem permissions. EPSS is low (0.28%, 21st percentile) and there is no public exploit identified at time of analysis, but the primitive is powerful and the fix is available in 1.12.0.
Server-Side Request Forgery (SSRF) and open-proxy behavior in Apache Kyuubi's Engine UI proxy exposes the Kyuubi server as a request forwarder to arbitrary internal or external hosts. Versions 1.8.0 through 1.11.x accept an attacker-controlled host and port from the HTTP request path and blindly proxy the request to that destination, enabling network pivoting into otherwise unreachable services behind the Kyuubi server. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; however, the unauthenticated network vector and trivial exploitation conditions make this a credible internal reconnaissance risk in exposed deployments.
Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local files which are not listed in the config. This issue affects Apache Kyuubi: from 1.6.0 through 1.10.2. [CVSS 8.8 HIGH]