CVE-2022-24697: Apache Kylin cube designer OS command injection via config override

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and full confidentiality, integrity, and availability impact, combined with a very high EPSS score.

What it is

Apache Kylin's cube designer lets a user overwrite system parameters in the configuration overwrites menu. By closing the single quotes around the value of the "-- conf=" parameter, an attacker can inject arbitrary operating system commands into the command line, achieving remote code execution. The flaw affects Kylin 2 through 2.6.5, Kylin 3 through 3.1.2, and Kylin 4 through 4.0.1.

Impact

An attacker can execute arbitrary operating system commands on the Kylin server, leading to full compromise of the host and any data or credentials it can reach.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication or user interaction required per the CVSS vector, and is triggered through the cube designer's configuration overwrites menu.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.84777, 99.7th percentile), indicating elevated likelihood of exploitation; references are patch and advisory links only, with no public exploit tag.

What to do

• Upgrade Apache Kylin to a version later than 2.6.5, 3.1.2, or 4.0.1 as applicable, following the vendor patch references.
• Restrict network access to the Kylin web interface and cube designer to trusted administrative networks.
• Enforce strong authentication and least-privilege roles so only authorized users can reach the cube designer configuration overwrites menu.
• Run the Kylin service under a low-privilege account to limit the impact of command execution.
• Monitor and audit changes to cube configuration parameters for unexpected shell metacharacters.

Detection

• Inspect Kylin logs and configuration change records for single quotes or shell metacharacters in the "-- conf=" parameter value.
• Alert on unexpected child processes spawned by the Kylin service account (for example shells or system utilities).
• Monitor outbound network connections originating from the Kylin server for signs of post-exploitation activity.
• Review cube designer configuration overwrite actions for anomalous or unauthorized users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.