PT-2024-31685 · Apache · Apache Druid

L0Ne1Y · Published 2024-09-17 · Updated 2024-10-01 · CVE-2024-45537

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Druid versions prior to 30.0.1

Description: The issue allows users with certain permissions to bypass restrictions on JDBC connections, potentially reading data from other database systems. This is possible by crafting a specific JDBC connection string when configuring a MySQL connection, allowing users to provide properties not on the allowed list. The functionality in question is used for setting up Druid lookups or running ingestion tasks. Users without the permission to configure JDBC connections cannot exploit this issue.

Recommendations: For versions prior to 30.0.1, update to Apache Druid 30.0.1 to resolve the issue. As a temporary workaround, consider restricting the configuration of JDBC connections to trusted administrators only, and ensure that the allowed properties list is carefully reviewed and restricted to necessary properties.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-45537

GHSA-JH66-3545-VPM7

Affected Products

Apache Druid

References · 10

• https://lists.apache.org/thread/2ovx1t77y6tlkhk5b42clp4vwo4c8cjv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45537 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45537 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jh66-3545-vpm7 · Vendor Advisory
• https://github.com/apache/druid · Note
• https://github.com/apache/druid/releases/tag/druid-30.0.1 · Note
• https://t.me/cvenotify/96758 · Telegram Post
• https://twitter.com/CVEnew/status/1836116164759466423 · Twitter Post
• https://t.me/cvedetector/5838 · Telegram Post
• https://twitter.com/oss_security/status/1836164092937052497 · Twitter Post