Skip to content
Nuclei Templates

InfluxDB <1.7.6 - Authentication Bypass

ID: CVE-2019-20933

Severity: critical

Author: pussycat0x,c-sh0

Tags: cve,cve2019,unauth,db,influxdb,misconfig,influxdata

Description

Section titled “Description”

InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

YAML Source

Section titled “YAML Source”
id: CVE-2019-20933


info:
  name: InfluxDB <1.7.6 - Authentication Bypass
  author: pussycat0x,c-sh0
  severity: critical
  description: InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the InfluxDB database.
  remediation: Update Influxdb to version 1.7.6~rc0-1 or higher.
  reference:
    - https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20933
    - https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6
    - https://nvd.nist.gov/vuln/detail/CVE-2019-20933
    - https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-20933
    cwe-id: CWE-287
    epss-score: 0.04237
    epss-percentile: 0.92253
    cpe: cpe:2.3:a:influxdata:influxdb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: influxdata
    product: influxdb
    shodan-query:
      - InfluxDB
      - http.title:"influxdb - admin interface"
      - influxdb
    fofa-query: title="influxdb - admin interface"
    google-query: intitle:"influxdb - admin interface"
  tags: cve,cve2019,unauth,db,influxdb,misconfig,influxdata


http:
  - method: GET
    path:
      - "{{BaseURL}}/query?db=db&q=SHOW%20DATABASES"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"results":'
          - '"name":"databases"'
        condition: and


      - type: status
        status:
          - 200
# digest: 490a0046304402204d03ad8fea7c4e3868205a2d6a45124bf6f5211acfdb9004e837f143a1ed3ed80220242386dc4e48c3c52c2515e3e2c599c1ffed76746c18bd59f13dd407a7c2f86f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-20933.yaml"

View on Github