Vulnerability Description
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Druid | <= 0.20.0 |
References
- http://packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Command-EExploitThird Party AdvisoryVDB Entry
- http://www.openwall.com/lists/oss-security/2021/01/29/6Mailing ListThird Party Advisory
- https://lists.apache.org/thread.html/r04fa1ba93599487c95a8497044d37f8c02a439bfcf
- https://lists.apache.org/thread.html/r121abe8014d381943b63c60615149d40bde9dc1c86
- https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c45bdefc32c9
- https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a7
- https://lists.apache.org/thread.html/r4f84b542417ea46202867c0a8b3eaf3b4cfed30e09
- https://lists.apache.org/thread.html/r5ef625076982aee7d23c23f07717e626b73f421fba
- https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4
- https://lists.apache.org/thread.html/r7dff4790e7a5c697fc0360adf11f5aeb31cd6ad806
- https://lists.apache.org/thread.html/r87aa94e28dd21ee2252d30c63f01ab9cb5474ee5bd
- https://lists.apache.org/thread.html/ra4225912f501016bc5e0ac44e14b8d6779173a3a1d
- https://lists.apache.org/thread.html/rc167d5e57f3120578718a7a458ce3e73b3830ac4ef
- https://lists.apache.org/thread.html/rea9436a4063927a567d698431ddae55e760c3f876c
- https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32eMailing ListVendor Advisory
FAQ
What is CVE-2021-25646?
CVE-2021-25646 is a vulnerability with a CVSS score of 8.8 (HIGH). Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by ...
How severe is CVE-2021-25646?
CVE-2021-25646 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-25646?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Druid.