166 matches found
Apache Druid 安全漏洞
A security vulnerability exists in Apache Druid, a column-oriented open source distributed database written in Java by the Apache Foundation, which stems from the fact that InputSource is used to read data from a data source in the Druid ingestion system. However, the HTTP InputSource allows an...
The vulnerability of the Apache Druid analytical database, related to deficiencies in authentication mechanisms, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Apache Druid analytical database is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
Apache Druid Privilege Permission and Access Control Issues Vulnerability
Apache Druid is the United States Apache Apache Foundation of a use of the Java language , written in column-oriented open source distributed database . Apache Druid has a security vulnerability that can be exploited by an attacker to read data from other sources e.g., the local file system using...
CVE-2021-26920 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not a...
GHSA-JJ4F-P7VV-J4V9 Arbitrary code execution in Apache Druid
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...
Arbitrary code execution in Apache Druid
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...
Code injection in Apache Druid
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a...
GHSA-WRQF-RRRW-W3MG Code injection in Apache Druid
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a...
Metasploit Wrap-Up
Operations shell Operations and management software make popular targets due to their users typically having elevated privileges across a network. Our own wvu contributed the VMware vRealize Operations vROps Manager SSRF RCE exploit module for the vulnerabilities discovered by security researcher...
Apache Druid 0.20.0 Remote Command Execution Exploit
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests; however, that feature is disabled by default. In Druid versions prior to 0.20.1, an authenticated user can send a specially-crafted request that both enables the JavaScript...
Apache Druid 0.20.0 Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Druid 0.20.0 Remote Command Execution', 'Description' = %q Apache Druid includes the ability to execute user-provided JavaScript code...
Remote Code Execution
Apache Druid is vulnerable to remote code execution. Certain properties supported by the MySQL JDBC driver allows an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes...
CVE-2021-26919
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...
CVE-2021-26919
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...
Code injection
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...
CVE-2021-26919
CVE-2021-26919 affects Apache Druid, where allowing users with certain JDBC permissions to supply MySQL JDBC properties not on the allowed list could enable code execution in Druid server processes via a malicious MySQL server. Documented behavior: trusted users can set up lookups or ingestion ta...
CVE-2021-26919 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.
Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker...
Apache Druid Detection
Binary data apachedruiddetect.nbin...
Apache Druid 安全漏洞
Apache Druid is a column-oriented, open source distributed database written in Java from the Apache Software Apache Foundation. A security vulnerability exists in Apache Druid 0.20.2, which can be exploited by an attacker to execute arbitrary code in the MYSQL process of the Druid server...
