PT-2021-16724 · Apache · Apache Druid

Litch1 + 1 · Published 2021-01-29 · Updated 2024-02-27 · CVE-2021-25646

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Druid versions 0.20.0 and earlier

Description The issue allows an authenticated user to send a specially-crafted request that forces Apache Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process. Over 3,000 unique attacks have been detected in the past month, indicating an attacker testing phase. The Lucifer Botnet is exploiting this issue for cryptomining.

Recommendations For Apache Druid versions 0.20.0 and earlier, consider disabling the JavaScript execution functionality until a patch is available. As a temporary workaround, restrict access to the Druid server to minimize the risk of exploitation. Avoid using the JavaScript code execution feature in untrusted environments. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-25646

GHSA-WRQF-RRRW-W3MG

Affected Products

Apache Druid

References · 54

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_druid_js_rce.rb · Exploit
• 🔥 https://github.com/Yang0615777/PocList · Exploit
• 🔥 https://github.com/1n7erface/PocList · Exploit
• 🔥 https://github.com/yaunsky/cve-2021-25646 · Exploit
• 🔥 https://github.com/Vulnmachines/Apache-Druid-CVE-2021-25646 · Exploit
• 🔥 https://github.com/givemefivw/CVE-2021-25646 · Exploit
• 🔥 http://packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Command-Execution.html · Exploit
• https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25646 · Security Note
• https://osv.dev/vulnerability/GHSA-wrqf-rrrw-w3mg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25646 · Vendor Advisory
• https://lists.apache.org/thread.html/r121abe8014d381943b63c60615149d40bde9dc1c868bcee90d0d0848@%3Ccommits.druid.apache.org%3E · Note
• https://twitter.com/fridaysecurity/status/1760685696434757692 · Twitter Post
• https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c45bdefc32c920b9986b941d8f%40%3Cannounce.apache.org%3E · Note
• https://t.me/cybersecuritytechnologies/2661 · Telegram Post