PT-2021-3992 · Apache · Apache Druid

Chybeta + 1 · Published 2021-07-02 · Updated 2023-06-13 · CVE-2021-26920

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Druid (affected versions not specified)

Description The issue is related to weaknesses in the authorization mechanism of Apache Druid's analytical database. It allows remote attackers to gain unauthorized access to protected information. Specifically, in the Druid ingestion system, the HTTP InputSource allows authenticated users to read data from unintended sources, such as the local file system, with the privileges of the Druid server process. This can be problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource but not the Local InputSource, enabling them to bypass application-level restrictions by passing a file URL to the HTTP InputSource.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Prototype Pollution

Weakness Enumeration

CWE-610

CWE-863

CWE-1321

Related Identifiers

BDU:2021-04514

CVE-2021-26920

GHSA-793H-6F7R-6QVM

GHSA-X3CC-X39P-42QX

Affected Products

Apache Druid

References · 27

• https://nvd.nist.gov/vuln/detail/CVE-2021-26920 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26920 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3cc-x39p-42qx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26920 · Security Note
• https://bdu.fstec.ru/vul/2021-04514 · Security Note
• https://lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-793h-6f7r-6qvm · Vendor Advisory
• https://github.com/NaturalIntelligence/fast-xml-parser · Note
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804 · Note
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-x3cc-x39p-42qx · Note
• https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7 · Note
• https://lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6de5c7c40dd92dab7518746fbaa2@%3Cannounce.apache.org%3E · Note
• https://t.me/cvenotify/21386 · Telegram Post
• https://t.me/cibsecurity/25883 · Telegram Post
• http://openwall.com/lists/oss-security/2021/09/24/1 · Note