c0126aa27f
16 changes to exploits/shellcodes DynoRoot DHCP - Client Command Injection DynoRoot DHCP Client - Command Injection Microsoft Internet Explorer 11 (Windows 7 x64/x86) - vbscript Code Execution Flash ActiveX 18.0.0.194 - Code Execution Microsoft Internet Explorer 11 - javascript Code Execution Flash ActiveX 28.0.0.137 - Code Execution (1) Flash ActiveX 28.0.0.137 - Code Execution (2) GNU glibc < 2.27 - Local Buffer Overflow NewsBee CMS 1.4 - Cross-Site Request Forgery ASP.NET jVideo Kit - 'query' SQL Injection PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting OpenDaylight - SQL Injection Timber 1.1 - Cross-Site Request Forgery Honeywell XL Web Controller - Cross-Site Scripting EU MRV Regulatory Complete Solution 1 - Authentication Bypass Linux/x86 - Reverse (10.10.2.4:4444/TCP) Shell Shellcode (68 bytes) Linux/x86 - Reverse (10.0.7.17:4444/TCP) Shell (/bin/sh) Shellcode (101 Bytes)
22 lines
No EOL
1.2 KiB
Text
22 lines
No EOL
1.2 KiB
Text
# Exploit Title: OpenDaylight SQL Injection
|
|
# Date: 2018-05-24
|
|
# Exploit Author: JameelNabbo
|
|
# Website: jameelnabbo.com
|
|
# Vendor Homepage: https://www.opendaylight.org
|
|
# CVE: CVE-2018-1132
|
|
|
|
|
|
intro:
|
|
OpenDaylight (ODL) is a modular open platform for customizing and automating networks of any size and scale. The OpenDaylight Project arose out of the SDN movement, with a clear focus on network programmability. It was designed from the outset as a foundation for commercial solutions that address a variety of use cases in existing network environments.
|
|
|
|
attackers can SQL inject the component's database(SQLite) without authenticating to the controller or SDNInterfaceapp.
|
|
|
|
The bug is in /impl/src/main/java/org/opendaylight/sdninterfaceapp/impl/database/SdniDataBase.java (line 373~391)
|
|
|
|
The SDNI concats port information to build an insert SQL query, and it executes the query in SQLite.
|
|
However, in line 386, the portName is a string that can be customized by switches. Since SQLite supports multiple sql queries in one run,
|
|
attackers can customize the port name to inject another SQL if they compromise or forge a switch.
|
|
|
|
POC:
|
|
For example, he can set portName as:
|
|
");drop table NAME;// |