Apache Kyuubi Engine UI Proxy Accepts Arbitrary Host Requests

Apache Kyuubi's REST API proxy component contains a Server-Side Request Forgery (SSRF) vulnerability that allows remote attackers to hijack the proxy functionality and force the Kyuubi server to send HTTP requests to arbitrary hosts on the network. By manipulating the host and port parameters in request paths, an unauthenticated attacker with network access can weaponize the server as an open proxy, potentially exfiltrating data, attacking internal systems, or pivoting deeper into network infrastructure. This vulnerability affects Kyuubi versions 1.8.0 through 1.11.x, impacting organizations running vulnerable deployments in production environments. The vulnerability is particularly dangerous because it requires no authentication and can operate at network speed, making it ideal for rapid reconnaissance and lateral movement attacks.

While this CVE does not map to specific MITRE ATT&CK techniques in the current threat model, Casky's Claude-powered analysis would detect attack patterns consistent with T1021 (Remote Service Session Initiation) and T1090 (Proxy) by identifying suspicious HTTP request chains originating from the Kyuubi service to unexpected internal or external destinations. Practitioners using Casky would observe detection findings highlighting anomalous outbound proxy traffic, unusual host/port combinations in request logs, and patterns of reconnaissance scanning behavior—all indicators of SSRF exploitation attempts. Casky's extended reasoning capabilities would correlate these suspicious request patterns with the known vulnerability surface, enabling security teams to differentiate legitimate proxy traffic from exploitation attempts and prioritize remediation before attackers establish persistent access pathways.