Chaofan Shou shouc

RCE in Risingwave UDF

Summary

An attacker with sufficient privileges to execute SQL queries can exploit a Remote Code Execution (RCE) vulnerability through User-Defined Functions (UDF) in Risingwave. By crafting a malicious UDF in Python, the attacker can execute arbitrary system commands on any compute nodes.

Details

The root cause of this issue is the lack of proper isolation and sanitization in the execution environment for Python UDFs (https://github.com/arrow-udf/arrow-udf/blob/main/arrow-udf-python/src/interpreter.rs#L37-L73). Attackers can abuse this to escalate their privileges from SQL execution to direct system-level access.

PoC

Execute following SQL:

Demo

Install Docker from https://www.docker.com/ and run our docker image (x86 only, running on non-x86 platform significantly degrades performance):

docker run -p 8000:8000 fuzzland/dev-ityfuzz-2

Then, you can visit the interface at http://localhost:8000

We couldn’t find that file to show.

0x00 Challenge

supervisord.conf:

[supervisord]
nodaemon=true

[program:gunicorn3]
command=gunicorn3 --workers=10 -b 0.0.0.0:5000 app:app

PyCrypto Writeup

To begin with, there is a very easy crypto chall. By solving it with collision, we can get:

key = "ASIS2020_W3bcrypt_ChAlLeNg3!@#%^"

Then, leverage this vuln (trentm/python-markdown2#348) to make /ticket to have XSS.

	import { TwitterApi } from 'twitter-api-v2';
	import { Configuration, OpenAIApi } from 'openai';
	import yargs from 'yargs';
	import { hideBin } from 'yargs/helpers';
	import TelegramBot from 'node-telegram-bot-api';
	import * as dotenv from 'dotenv';

	dotenv.config();

	enum Victim {

	8L4rzMRbR7jhcNk4b8K21DpWZzuKbH6E2rzK4Bb1Hax7
	3rnGfoT7BetuSKYos73gJHFBU71fVc8VZ7r2ueiL8Z8Q
	S9xEvekhQGjAeUmqSSwaQciRn8exxPKYZCLroG6Q2Xh
	HLkdmrVTMaeEtAUeasgQc4NnQ5bS6tZFMqAKD2Y7xY9t
	9BEXSQvDUc6yeqAWsRtGHn2nKDqogV6yRx17NqJBPGXF
	kLeSXWbdb7ypCyriQm6AWgT8VPGLZ9rq5wiNkqa2q4C
	HEjLQwphRZQuh3y4u3VgWueBAzFCaMsesqVqdEzvLoRc
	9gnm6c3DxihcexxNUA91PUumFp8TWufLmRxEfYRraTCw
	3u1Kk1ekg76e1APnfNEP57yX8u79PoK5GR3FU1UkM1SU
	3LUEzTtheTALFjZaJQJXb3RvHa4quaxkFAbbL8shNSYR

	### Keybase proof

	I hereby claim:

	* I am shouc on github.
	* I am shouc (https://keybase.io/shouc) on keybase.
	* I have a public key ASBreqhIMBEuTvygWcONLGZVL4mbrI1irDWEItXzfbCdhAo

	To claim this, I am signing this object:

	// by https://twitter.com/publicqi & https://twitter.com/shoucccc

	contract PuzzleBoxSolution {
	constructor() payable {}
	fallback() payable external {
	if (msg.data.length > 32) {
	assembly{
	// let x := 0x80
	let target := 0x69209d8a7d258515ec9a4d25f7be1db85cb1b826

	#include "DecodeCode.h"


	mipsinstruction decode(int value)
	{
	mipsinstruction instr;
	unsigned int v = (unsigned int) value;
	instr.funct = v & 0b111111;
	instr.immediate = value & 0b1111111111111111;
	unsigned short is_signed = instr.immediate >> 15;