When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP
    credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP
    user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if
    configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the
    LDAP server, so long as that information is visible to the Druid server. This information disclosure does
    not require the caller itself to be a valid LDAP user. (CVE-2020-1958)

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418132	SCA: security update for org.apache.druid:druid (GHSA-qh2g-7h5p-mxf4)	Tenable Cloud Security	SCA Checks	medium
418132	SCA: security update for org.apache.druid:druid (GHSA-qh2g-7h5p-mxf4)	Tenable Self-Hosted Container Security	SCA Checks	medium
181681	Apache Druid < 0.17.1 LDAP Injection	Nessus	Misc.	medium

Detections

Analytics

CVE-2020-1958

medium

Tenable Plugins

medium

medium

medium