[FD] Security advisory: Pre-authentication RCE in DataStax Enterprise (DSE) 6.8.49 (DataStax)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in DataStax 
Enterprise (DSE) 6.8.49 (DataStax). The research is published and a 
proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

DataStax Enterprise (DSE) 6.8.49 runs a Gremlin Server on WebSocket 8182. The 
default configuration has the gremlin_server authentication section commented 
out, which means TinkerPop's default allowAll authenticator - no 
authentication. The gremlin-groovy sandbox is enabled by default, but the 
sandbox only wraps the top-level submitted script; 
groovy.lang.Script.evaluate(String) creates a fresh GroovyShell with a default 
CompilerConfiguration that does not include the SandboxTransformer, so a nested 
string is compiled and executed sandbox-free. An attacker submits 
this.evaluate("<nested script>"); the nested script runs 
["/bin/sh","-c","<cmd>"].execute().text, executing arbitrary system commands as 
the dse user. Dynamically verified.

Impact: Full read of the host filesystem and configuration as the dse user, 
arbitrary OS command execution, and full control of the DSE host and database 
services.

Advisory: https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/