CVE-2021-36749

CVE-2021-36749 Apache Druid LoadData 任意ファイル読み取り脆弱性 Code By:Junsheng @橘子ネットワークセキュリティラボ 橘子ネットワークセキュリティラボ https://0range.team/ 0x00 リスク概要 本ツールは許可されたセキュリティテストのみに使用し、無許可の不正攻撃サイトへの使用を禁止します。 オンラインで閲覧『中華人民共和国サイバーセキュリティ法』 0x01 ツールの使用 アセットを整理した後、url.txtに格納し、コマンドラインでPython CVE-2021-26749.pyを入力します。 0x02 バグ報告...

apache_druid_CVE-2021-36749

apachedruidCVE-2021-36749 CVE-2021-36749 Docker 脆弱性再現 Dockerイメージをインポート： docker import apachedruid.tar apache:1 Dockerを起動： docker run -id --name apachedruid -p 8081:8081 -p 8082:8082 -p 8083:8083 -p 8888:8888 -p 8091:8091 -p 2181:2181 イメージID /bin/bash...

Exploit for Incorrect Authorization in Apache Druid

CVE-2021-36749 Apache Druid 任意文件读取 受影响版本：version = 0.21.1 使...

CVE-2021-36749

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

CVE-2021-36749

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...

CVE-2021-36749 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...