Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
| Link | Tags |
|---|---|
| https://www.aerospike.com/docs/operations/configure/security/access-control/index.html#create-users-and-assign-roles | vendor advisory exploit |
| https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html | third party advisory exploit |
| https://www.aerospike.com/download/server/notes.html#5.1.0.3 | release notes vendor advisory |
| https://www.aerospike.com/enterprise/download/server/notes.html#5.1.0.3 | release notes vendor advisory |
| http://packetstormsecurity.com/files/160106/Aerospike-Database-5.1.0.3-Remote-Command-Execution.html | third party advisory vdb entry exploit |
| http://packetstormsecurity.com/files/160451/Aerospike-Database-UDF-Lua-Code-Execution.html | third party advisory vdb entry exploit |