Security advisory: Pre-authentication RCE in DataStax Enterprise (DSE) 6.8.49 (DataStax)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in DataStax Enterprise (DSE) 6.8.49 (DataStax). The 
research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

DataStax Enterprise (DSE) 6.8.49 runs a Gremlin Server on WebSocket 8182. The default configuration has the 
gremlin_server authentication section commented out, which means TinkerPop's default allowAll authenticator - no 
authentication. The gremlin-groovy sandbox is enabled by default, but the sandbox only wraps the top-level submitted 
script; groovy.lang.Script.evaluate(String) creates a fresh GroovyShell with a default CompilerConfiguration that does 
not include the SandboxTransformer, so a nested string is compiled and executed sandbox-free. An attacker submits 
this.evaluate("<nested script>"); the nested script runs ["/bin/sh","-c","<cmd>"].execute().text, executing arbitrary 
system commands as the dse user. Dynamically verified.

Impact: Full read of the host filesystem and configuration as the dse user, arbitrary OS command execution, and full 
control of the DSE host and database services.

Advisory: https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/