Log in Start free

Vulnerability · Published Jan 29, 2021 · Assigned by apache

CVE-2021-25646Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

High 8.8

In plain English

A high-severity security flaw in Apache Druid from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 99.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)99.1%top 0.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling3Metasploit, Nuclei, Public PoC

Official description

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.druid:druid0.20.1GHSA-wrqf-rrrw-w3mg

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Druid 0.20.0 and earlier – through 0.20.0

References