Patchfirst
Patchfirst
CVE-2021-36749 Public exploit EPSS 80.9%

Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended…

Apache Software Foundation · Apache Druid

Summary

Apache Druid's HTTP InputSource, used during data ingestion, can be abused to read files from sources other than intended, such as the local file system, with the privileges of the Druid server process. An attacker who is an authenticated user can exploit this, particularly when interacting with Druid through an application that permits the HTTP InputSource but blocks the Local InputSource, by passing a file URL to bypass that restriction.

Official description · CVE.org

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.

Breakdown
59.9 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 8 months after disclosure. Public exploit code (PoC-in-GitHub) was available 4 months before disclosure.

  1. Public exploit codePoC-in-GitHub4 mo before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+8 mo

See the family tree

3 related vulnerabilities in the same code over 2 years.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2021-26920Druid: The HTTP inputSource allows authenticated users to read…2 Jul 2021
  2. relatedHigh

    Why these are linked:

    • Linked in OSV/GitHub advisoryGHSA-9p5g-vg43-mj5r
    • Similar weakness in the same product (machine-matched)same product + description similarity
    This CVECVE-2021-36749Druid: The HTTP inputSource allows authenticated users to read…24 Sep 2021
  3. relatedHigh

    Why these are linked:

    CVE-2023-26920fast-xml-parser before 4.1.2 allows __proto__ for Prototype…12 Dec 2023

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.druid:druid-core.

Mavenorg.apache.druid:druid-coreGHSA-9p5g-vg43-mj5r

Upgrade to 0.22.0 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2021-26920).

Set the version to 0.22.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2021-36749.

Affected versions

If you runUpgrade to
All versions before 0.22.00.22.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_MISC 1

lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3E

mailing-list 1

lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3E
↑ ↓ chooseEnter openEsc close