CVE-2019-20933 PoC — Influxdata InfluxDB 授权问题漏洞

Source

https://github.com/Hydragyrum/CVE-2019-20933

Associated Vulnerability

Title:Influxdata InfluxDB 授权问题漏洞 (CVE-2019-20933)
Description:Influxdata Influxdata InfluxDB是美国Influxdata公司的一个基于Go开发的时序性数据库。 Influxdata InfluxDB 1.7.6之前版本存在安全漏洞，该漏洞源于在服务httpd处理程序的身份验证功能中，有一个身份验证绕过漏洞。因为JWT令牌可能有一个空的SharedSecret(又名shared secret)。

Readme

# CVE-2019-20933

> InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

(see [https://nvd.nist.gov/vuln/detail/CVE-2019-20933](https://nvd.nist.gov/vuln/detail/CVE-2019-20933) For more details)

## PoC

This PoC exploits the above CVE to make a quick and dirty influxDB client.

## Usage:

usage: influx-client.py [-h] [--host HOST] [--port PORT] [--user USER] [--db DB] query

A simple, silly, over-the-top influxdb client made in Python

positional arguments:
  query                 The query to execute. default: SHOW DATABASES

optional arguments:
  -h, --help            show this help message and exit
  --host HOST           The target IP. (default: localhost)
  --port PORT, -p PORT  The target port. (default: 8086)
  --user USER           The target username. (default: admin)
  --db DB               The database to use.

## Acknowledgements

Portions of code borrowed from https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933

File Snapshot


 [4.0K]  /data/pocs/1d3bc28ab2cf8ad1930c0333bce95385f70739a4
├── [2.0K]  influx-client.py
├── [1.0K]  LICENSE
├── [1.1K]  README.md
└── [ 174]  requirements.txt

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!