In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Druid ingestion system, the InputSource is used for reading data from a certain data source.
    However, the HTTP InputSource allows authenticated users to read data from other sources than intended,
    such as the local file system, with the privileges of the Druid server process. This is not an elevation
    of privilege when users access Druid directly, since Druid also provides the Local InputSource, which
    allows the same level of access. But it is problematic when users interact with Druid indirectly through
    an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this
    case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
    (CVE-2021-26920)

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
411952	SCA: security update for org.apache.druid:druid-core (GHSA-793h-6f7r-6qvm)	Tenable Cloud Security	SCA Checks	medium
411952	SCA: security update for org.apache.druid:druid-core (GHSA-793h-6f7r-6qvm)	Tenable Self-Hosted Container Security	SCA Checks	medium
181677	Apache Druid < 0.21.0 Privilege Escalation	Nessus	Misc.	medium

Detections

Analytics

CVE-2021-26920

medium

Tenable Plugins

medium

medium

medium