CVE-2021-25646 PoC — Apache Druid 访问控制错误漏洞

Description

Exploit for Apache Druid Embedded Javascript Remote Code Execution (CVE-2021-25646), Python.

介绍

# Apache Druid RCE Exploit (CVE-2021-25646)

Python exploit for Apache Druid Remote Code Execution via JavaScript code injection (CVE-2021-25646).

## Description

This script exploits an RCE vulnerability in Apache Druid (versions < 0.20.1) that allows arbitrary code execution through specially crafted sampler requests.

## Usage

```bash
python3 druid_rce.py -u http://target:8888 -c "command_to_execute"
```

### Arguments
- `-u/--url` - Target URL (e.g., `http://vulnerable-host:8888`)
- `-c/--command` - Command to execute on target system

## Example

```bash
python3 druid_rce.py -u http://192.168.1.100:8888 -c "id"
```

## Requirements

- Python 3.x
- `requests` library (`pip install requests`)

## Disclaimer

This tool is for **educational and authorized penetration testing purposes only**. Never use it against systems without explicit permission. The author is not responsible for any misuse.

P.S. Author: Коротков Виталий Константинович.

文件快照

备注