Patchfirst
Patchfirst
CVE-2021-26920 EPSS 9.5%

Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended

Apache Software Foundation · Apache Druid

Official description · CVE.org

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.

Breakdown
54.1 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

Disclosed on 2 Jul 2021. No public exploit code or confirmed exploitation is recorded.

See the family tree

3 related vulnerabilities in the same code over 2 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2021-26920Druid: The HTTP inputSource allows authenticated users to read…2 Jul 2021
  2. relatedHigh

    Why these are linked:

    • Linked in OSV/GitHub advisoryGHSA-9p5g-vg43-mj5r
    • Similar weakness in the same product (machine-matched)same product + description similarity
    CVE-2021-36749Druid: The HTTP inputSource allows authenticated users to read…24 Sep 2021
  3. relatedHigh

    Why these are linked:

    CVE-2023-26920fast-xml-parser before 4.1.2 allows __proto__ for Prototype…12 Dec 2023

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.druid:druid-core.

Mavenorg.apache.druid:druid-coreGHSA-793h-6f7r-6qvm

Upgrade to 0.22.0 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-36749).

Set the version to 0.22.0 or later in your pom.xml or build.gradle.

First fixed in 0.21.0 for CVE-2021-26920.

Affected versions

If you runUpgrade to
All versions before 0.21.00.22.0first fix for this CVE: 0.21.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

6 links, grouped by NVD tag

x_refsource_MISC 1

lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3E

mailing-list 5

openwall.com/lists/oss-security/2021/07/02/1lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6de5c7c40dd92dab7518746fbaa2%40%3Cannounce.apache.org%3Elists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3Eopenwall.com/lists/oss-security/2021/09/24/1lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3E
↑ ↓ chooseEnter openEsc close