Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of
    requests. This functionality is intended for use in high-trust environments, and is disabled by default.
    However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted
    request that forces Druid to run user-provided JavaScript code for that request, regardless of server
    configuration. This can be leveraged to execute code on the target machine with the privileges of the
    Druid server process. (CVE-2021-25646)

A change introduced in Apache Druid prior to 0.20.1 allows attackers to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an unauthenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

ID	Name	Product	Family	Type	Severity
420105	SCA: security update for org.apache.druid:druid (GHSA-wrqf-rrrw-w3mg)	Tenable Cloud Security	SCA Checks	Local	high
420105	SCA: security update for org.apache.druid:druid (GHSA-wrqf-rrrw-w3mg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
148241	Apache Druid < 0.20.1 RCE (Direct Check)	Nessus	Web Servers	Remote	high

Detections

Analytics

CVE-2021-25646

high

Tenable Plugins

high

high

high