CVE-2021-36749
MEDIUM EXPLOITED IN THE WILD NUCLEIApache Druid < 0.22.0 - Authenticated Arbitrary File Read via HTTP InputSource
Title source: llmExploitation Summary
CVE-2021-36749 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 5 public exploits from researchers including sma11new, BrucessKING, zwlsix. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2021-36749, an arbitrary file read vulnerability in Apache Druid. The exploit sends a crafted JSON payload to the Druid sampler endpoint to read files from the target system.
Description
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
Exploits (5)
The repository contains a functional Python exploit for CVE-2021-36749, an arbitrary file read vulnerability in Apache Druid. The exploit sends a crafted JSON payload to the Druid sampler endpoint to read files from the target system.
The repository contains a functional Python script that exploits CVE-2021-36749, an arbitrary file read vulnerability in Apache Druid. The exploit sends a crafted POST request to the Druid sampler endpoint, leveraging a misconfigured 'file://' URI to read sensitive files like '/etc/passwd'.
The repository provides instructions for setting up a Docker environment to reproduce CVE-2021-36749 but lacks actual exploit code. It directs users to an external download link for the Docker image, which is a common tactic for suspicious repositories.
This repository contains a functional Python exploit for CVE-2021-36749, an arbitrary file read vulnerability in Apache Druid. The script crafts a malicious HTTP request to the Druid sampler endpoint to read files from the target system, such as /etc/passwd, and saves the output to a local file.
This repository contains a functional Python script that exploits CVE-2021-36749, an arbitrary file read vulnerability in Apache Druid. The exploit sends a crafted HTTP request to the Druid indexer endpoint to read files from the target system, such as /etc/passwd, and saves the output to a local file.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N