InfluxDB <1.7.6 - Authentication Bypass

criticalseverity

9.8CVSS score

32.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

An attacker can bypass authentication and gain unauthorized access to the InfluxDB database.

Fix

Update Influxdb to version 1.7.6~rc0-1 or higher.

How to confirm it

Send: GET {{BaseURL}}/query?db=db&q=SHOW%20DATABASES
Positive when: contains "\"results\":" and "\"name\":\"databases\"" AND status 200

Run it with nuclei: nuclei -id CVE-2019-20933 -u <target>

The full check

id: CVE-2019-20933

info:
  name: InfluxDB <1.7.6 - Authentication Bypass
  author: pussycat0x,c-sh0
  severity: critical
  description: InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the InfluxDB database.
  remediation: Update Influxdb to version 1.7.6~rc0-1 or higher.
  reference:
    - https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933
    - https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6
    - https://nvd.nist.gov/vuln/detail/CVE-2019-20933
    - https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-20933
    cwe-id: CWE-287
    epss-score: 0.32298
    epss-percentile: 0.98336
    cpe: cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: influxdata
    product: influxdb
    shodan-query:
      - InfluxDB
      - http.title:"influxdb - admin interface"
      - influxdb
    fofa-query: title="influxdb - admin interface"
    google-query: intitle:"influxdb - admin interface"
  tags: cve,cve2019,unauth,db,influxdb,misconfig,influxdata,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/query?db=db&q=SHOW%20DATABASES"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"results":'
          - '"name":"databases"'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from