PT-2020-15191 · Apache · Apache Druid

Published 2020-04-01 · Updated 2022-04-06 · CVE-2020-1958

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Druid version 0.17.0

Description The issue allows callers of Druid APIs with valid LDAP credentials to bypass the credentialsValidator.userSearch filter, which determines if a valid LDAP user can authenticate with Druid. Although role-based authorization checks still apply if configured, callers can also retrieve any visible LDAP attribute values of users on the LDAP server without needing to be a valid LDAP user themselves.

Recommendations For Apache Druid version 0.17.0, consider disabling LDAP authentication until a patch is available to prevent bypassing the credentialsValidator.userSearch filter and unauthorized retrieval of LDAP attribute values. Restrict access to Druid APIs to minimize the risk of exploitation. Avoid using the credentialsValidator.userSearch filter in the affected API endpoints until the issue is resolved.

Exploit

Fix

Special Elements Injection

Information Disclosure

Weakness Enumeration

CWE-74

CWE-200

Related Identifiers

CVE-2020-1958

GHSA-QH2G-7H5P-MXF4

Affected Products

Apache Druid

References · 23

• 🔥 https://github.com/ggolawski/CVE-2020-1958 · Exploit
• https://lists.apache.org/thread.html/r9d437371793b410f8a8e18f556d52d4bb68e18c537962f6a97f4945e%40%3Cdev.druid.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1958 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1958 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qh2g-7h5p-mxf4 · Vendor Advisory
• https://github.com/apache/druid/pull/9600#issuecomment-607497875 · Note
• https://github.com/apache/druid/commit/dbaabdd24710fef726c5730c609937706f456a44#diff-fab6b7a8a160a405e787690201aade5462961550c97715ab18de6ad07a3edf7e · Note
• https://lists.apache.org/thread.html/rf70876ecafb45b314eff9d040c5281c4adb0cb7771eb029448cfb79b@%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/rffabc9e83cc2831bbee5db32b3965b84b09346a26ebc1012db63d28c%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r1526dbce98a138629a41daa06c13393146ddcaf8f9d273cc49d57681@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r47c90a378efdb3fd07ff7f74095b8eb63b3ca93b8ada5c2661c5e371%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r1c32c95543d44559b8d7fd89b0a85f728c80e8b715685bbf788a15a4@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r026540c617d334007810cd8f0068f617b5c78444be00a31fc1b03390%40%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r75e74d39c41c1b95a658b6a9f75fc6fd02b1d1922566a0ee4ee2fdfc@%3Ccommits.druid.apache.org%3E · Note
• https://lists.apache.org/thread.html/r75e74d39c41c1b95a658b6a9f75fc6fd02b1d1922566a0ee4ee2fdfc%40%3Ccommits.druid.apache.org%3E · Note