Vulnerability · Published Aug 5, 2020 · Assigned by mitre

CVE-2020-13151

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 86.5% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)86.5%top 0.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Metasploit, Public PoC

Official description

Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.aerospike.com/docs/operations/configure/security/access-control/index.html#create-users-and-assign-roles x_refsource_MISC
https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html x_refsource_MISC
https://www.aerospike.com/download/server/notes.html#5.1.0.3 x_refsource_MISC
https://www.aerospike.com/enterprise/download/server/notes.html#5.1.0.3 x_refsource_MISC
http://packetstormsecurity.com/files/160106/Aerospike-Database-5.1.0.3-Remote-Command-Execution.html x_refsource_MISC
http://packetstormsecurity.com/files/160451/Aerospike-Database-UDF-Lua-Code-Execution.html x_refsource_MISC