.. / CVE-2019-20933

• Auth Bypass
• PoC
• Nuclei
• Web
• Hack The Box

Exploit for InfluxDB <1.7.6 - Authentication Bypass (CVE-2019-20933)

Description:

InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret (aka shared secret). An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Nuclei Template

View the template here CVE-2019-20933.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-20933.yaml

Try the exploit in a lab environment:

References: