yaunsky/cve-2021-25646Apache Druid 远程代码执行;检测脚本
Apache Druid Remote Code Execution
Vulnerability Summary
Apache Druid has released a security update announcing a remote code execution vulnerability, numbered CVE-2021-25646. Due to the lack of authorization and authentication by default in Apache Druid, attackers can send specially crafted requests to execute arbitrary code with the privileges of the Druid server process.
Apache Druid is a column-oriented, open-source distributed data store written in Java, designed to quickly ingest large amounts of event data and provide low-latency queries on top of that data. Druid is designed to quickly ingest large amounts of event data and provide low-latency queries on top of that data. Druid is commonly used in business intelligence/OLAP applications to analyze large volumes of real-time and historical data.
Help
python3 cve-2021-25646 --help
Detection Method
python3 cve-2021-25646.py -h http://192.168.130.142:8888
The vulnerability detection is performed using dnslog logs. According to your personal dnslog address, modify line 52 of the script: ping **.dnslog.
Using the content of this project for illegal activities, the author assumes no responsibility; any consequences shall be borne by the user.