PT-2021-21335 · Druid · Druid

Abking + 2 · Published 2021-09-24 · Updated 2022-07-12 · CVE-2021-36749

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Druid versions prior to 0.21.0

Description The issue concerns the Druid ingestion system, specifically the HTTP InputSource, which allows authenticated users to read data from unintended sources, such as the local file system, with the privileges of the Druid server process. This is problematic when users interact with Druid indirectly through an application that restricts access to certain input sources. Users could bypass application-level restrictions by passing a file URL to the HTTP InputSource.

Recommendations For versions prior to 0.21.0, as a temporary workaround, consider restricting access to the HTTP InputSource to minimize the risk of exploitation. Avoid using the HTTP InputSource in applications that do not intend to allow access to the local file system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-863

CWE-668

Related Identifiers

CVE-2021-36749

GHSA-9P5G-VG43-MJ5R

Affected Products

Druid

References · 15

• 🔥 https://github.com/sma11new/PocList · Exploit
• 🔥 https://github.com/Sma11New/PocList · Exploit
• 🔥 https://github.com/BrucessKING/CVE-2021-36749 · Exploit
• 🔥❌ https://github.com/dorkerdevil/CVE-2021-36749 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-36749 · Security Note
• https://osv.dev/vulnerability/GHSA-9p5g-vg43-mj5r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36749 · Vendor Advisory
• https://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3E · Vendor Advisory
• https://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3E · Note
• https://t.me/cvenotify/21387 · Telegram Post
• https://unit42.paloaltonetworks.com/network-security-trends-cross-site-scripting · Note
• https://t.me/cybersecuritytechnologies/4533 · Telegram Post
• https://t.me/cibsecurity/29357 · Telegram Post
• https://github.com/advisories/GHSA-793h-6f7r-6qvm · Note
• https://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be@%3Cannounce.apache.org%3E · Note