CVE-2021-25646 PoC — Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

Source

https://github.com/luobai8/CVE-2021-25646-exp

Associated Vulnerability

Title:Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. (CVE-2021-25646)
Description:Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

Description

CVE-2021-25646 Apache Druid 远程代码执行 漏洞检测和利用工具

Readme

# CVE-2021-25646-exp
Apache druid CVE-2021-25646 远程代码执行漏洞检测、利用工具
输入域名或者ip:端口，可以进行漏洞检测

对检测到漏洞的目标可以进行命令执行利用
支持单个目标
支持从文档中按行读取多个目标
## （靶场演示）

## 漏洞检测
![image](https://github.com/user-attachments/assets/84b09fd6-09b5-4271-acbb-7d67650acced)

## 漏洞利用，执行 `id` 命令
![image](https://github.com/user-attachments/assets/41dec0be-5851-444a-b441-21443354cb5f)

## 反弹shell
反弹shell命令使用双引号括起来，不然会报错
少许卡顿之后，成功反弹shell
![image](https://github.com/user-attachments/assets/294e8c85-7383-4b02-9f0f-595d148447a7)
![image](https://github.com/user-attachments/assets/3fbb1404-dec7-4098-8746-e3afbe5e862e)

## 免责声明
本工具仅面向合法授权的企业安全建设行为，如您需要测试本工具的可用性，请自行搭建靶机环境。

在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。请勿对非授权目标进行扫描。

如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我将不承担任何法律及连带责任。

您的使用行为或者您以其他任何明示或者默示方式表示接受本协议的，即视为您已阅读并同意本协议的约束。

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!