CVE-2026-62390 & Apache Flaws: Critical SQLi and Auth Bypass Analysis

---
title: Potential Apache Kylin SQL Injection via Catalog Refresh
id: 1a2b3c4d-5e6f-7890-1a2b-3c4d5e6f7890
status: experimental
description: Detects potential SQL injection attempts targeting the Apache Kylin catalog refresh API endpoint. Identifies common SQLi syntax in URL parameters or POST bodies targeting known API paths.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62390
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.62390
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs-uri-query|contains:
      - '/api/tables'
      - '/api/catalog'
      - 'refresh'
  selection_sqli:
    cs-uri-query|contains:
      - 'UNION SELECT'
      - 'OR 1=1'
      - 'DROP TABLE'
      - 'exec('
      - 'waitfor delay'
  condition: selection_uri and selection_sqli
falsepositives:
  - Legitimate developer testing with SQL keywords in parameters (low probability)
level: high
---
title: Apache Doris Unauthenticated Admin API Access
id: 2b3c4d5e-6f78-901a-2b3c-4d5e6f789012
status: experimental
description: Detects successful access (HTTP 200) to Apache Doris administrative endpoints without prior authentication, indicative of CVE-2026-58319 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-58319
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.58319
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/_admin'
      - '/api/bootstrap'
      - '/api/check_health'
  selection_success:
    sc-status: 200
  # Contextual check: Doris usually runs on ports 8030 (http) or 9030 (query)
  selection_port:
    c-dst-port:
      - 8030
      - 9030
  condition: selection_endpoint and selection_success and selection_port
falsepositives:
  - Authorized health checks from load balancers (whitelist IP required)
level: critical
---
title: Java Application Spawning Shell (OS Command Injection)
id: 3c4d5e6f-7890-1a2b-3c4d-5e6f78901234
status: experimental
description: Detects Java-based services (like Apache Kylin or Doris) spawning shell processes, a strong indicator of successful OS Command Injection exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-62392
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.62392
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/jre/bin/java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/nc'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts executed by the application (rare)
level: high


**KQL (Microsoft Sentinel / Defender)**

// Hunt for SQL Injection patterns in Apache logs targeting Kylin
let sqli_patterns = dynamic(["UNION+SELECT", "OR+1=1", "DROP+TABLE", "EXEC(", "waitfor+delay", ";--"]);
CommonSecurityLog
| where DeviceVendor in ("Apache", "Ubuntu", "Linux")
| where RequestMethod in ("POST", "GET")
| where CSUriQuery has_any ("api/tables", "api/catalog", "refresh")
| where CSUriQuery has_any (sqli_patterns)
| project TimeGenerated, DeviceIP, SourceIP, DestinationPort, CSUriQuery, RequestMethod
| extend KQL_Timestamp = TimeGenerated
| order by TimeGenerated desc

// Hunt for Apache Doris Auth Bypass (Successful Admin Access without Auth)
CommonSecurityLog
| where DeviceVendor in ("Apache")
| where DestinationPort in (8030, 9030)
| where CSUriPath has_any ("/api/_admin", "/api/bootstrap")
| where DeviceCustomBool4 == false // Assuming this field or similar indicates missing auth, or filter for 200 OK only
| where Activity == "200" // Or equivalent status code field
| project TimeGenerated, SourceIP, DestinationIP, CSUriPath, Activity
| order by TimeGenerated desc


**Velociraptor VQL**

-- Hunt for Java processes (Kylin/Doris) spawning suspicious shells
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.CommandLine AS ParentCmd
FROM pslist()
WHERE Name IN ('sh', 'bash', 'dash', 'nc.traditional', 'nc.openbsd')
  AND Parent.Name IN ('java', 'kylin.sh', 'doris_fe.sh')
  AND Exe != '/bin/false'


**Remediation Script (Bash)**

#!/bin/bash
# Apache Kylin and Doris Security Audit Script for CVE-2026-62390, CVE-2026-62392, CVE-2026-58319

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

echo -e "${GREEN}[*] Starting Apache Security Audit...${NC}"

# Check for Apache Kylin Instances
echo -e "${YELLOW}[*] Checking for Apache Kylin installations...${NC}"
KYLIN_PROC=$(pgrep -f "org.apache.kylin" 2>/dev/null)
if [ -n "$KYLIN_PROC" ]; then
    echo -e "${RED}[!] Apache Kylin process detected (PID: $KYLIN_PROC)${NC}"
    # Attempt to find version (requires knowing install path, common locations below)
    for dir in /opt/kylin /usr/local/kylin /home/*/kylin; do
        if [ -f "$dir/lib/kylin-server-core-*.jar" ]; then
            echo -e "${YELLOW}[*] Found Kylin installation at $dir${NC}"
            # Extract version from jar name (heuristic)
            ls "$dir/lib/kylin-server-core-"*.jar | head -1
        fi
    done
    echo -e "${RED}[!] ACTION REQUIRED: Upgrade Apache Kylin to version 5.0.4 or higher immediately.${NC}"
else
    echo -e "${GREEN}[+] No running Apache Kylin process detected.${NC}"
fi

# Check for Apache Doris Instances
echo -e "${YELLOW}[*] Checking for Apache Doris installations...${NC}"
DORIS_PROC=$(pgrep -f "doris_fe" 2>/dev/null)
if [ -n "$DORIS_PROC" ]; then
    echo -e "${RED}[!] Apache Doris FE process detected (PID: $DORIS_PROC)${NC}"
    echo -e "${YELLOW}[*] Checking for exposed admin ports (8030, 9030)...${NC}"
    if netstat -tuln 2>/dev/null | grep -E ':8030|:9030' > /dev/null; then
        echo -e "${RED}[!] Admin ports are listening. Ensure firewall rules restrict access and patches for CVE-2026-58319 are applied.${NC}"
    fi
else
    echo -e "${GREEN}[+] No running Apache Doris FE process detected.${NC}"
fi

echo -e "${GREEN}[*] Audit complete.${NC}"