Vulnerability Description
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Aerospike | Aerospike Server | < 4.5.3.21 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/160106/Aerospike-Database-5.1.0.3-Remote-CoExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/160451/Aerospike-Database-UDF-Lua-Code-ExecExploitThird Party AdvisoryVDB Entry
- https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospikeExploitThird Party Advisory
- https://www.aerospike.com/docs/operations/configure/security/access-control/indeExploitVendor Advisory
- https://www.aerospike.com/download/server/notes.html#5.1.0.3Release NotesVendor Advisory
- https://www.aerospike.com/enterprise/download/server/notes.html#5.1.0.3Release NotesVendor Advisory
- http://packetstormsecurity.com/files/160106/Aerospike-Database-5.1.0.3-Remote-CoExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/160451/Aerospike-Database-UDF-Lua-Code-ExecExploitThird Party AdvisoryVDB Entry
- https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospikeExploitThird Party Advisory
- https://www.aerospike.com/docs/operations/configure/security/access-control/indeExploitVendor Advisory
- https://www.aerospike.com/download/server/notes.html#5.1.0.3Release NotesVendor Advisory
- https://www.aerospike.com/enterprise/download/server/notes.html#5.1.0.3Release NotesVendor Advisory
FAQ
What is CVE-2020-13151?
CVE-2020-13151 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code exec...
How severe is CVE-2020-13151?
CVE-2020-13151 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-13151?
Check the references section above for vendor advisories and patch information. Affected products include: Aerospike Aerospike Server.