Listen to this Post
The CVE-2025-12345 vulnerability in Apache Druid stems from a weak fallback mechanism for the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration parameter. When system administrators do not explicitly set a strong, shared secret for signing Kerberos authentication cookies, the system automatically generates one using ThreadLocalRandom. This Java class is designed for performance in non-security contexts and does not provide a cryptographically secure random number generator (CSPRNG). The generated fallback secret lacks sufficient entropy, making it predictable and susceptible to brute-force attacks. A remote attacker could feasibly guess or calculate the secret value. With the secret compromised, the attacker can forge valid authentication cookies, bypassing the Kerberos authentication process entirely and gaining unauthorized access to the Druid cluster. Furthermore, in distributed deployments, each node or broker generates its own independent, weak secret, leading to authentication inconsistencies and service failures even in the absence of an active attack.
Platform: Apache Druid
Version: through 34.0.0
Vulnerability : Authentication Bypass
Severity: Critical
date: 2025-01-15
Prediction: Patch 2025-01-29
What Undercode Say:
grep -r "cookieSignatureSecret" /opt/druid/conf/ cat /opt/druid/conf/druid/cluster/_common/common.runtime.properties | grep kerberos
// Pseudo-code for weak secret generation
if (config.secret == null) {
weakSecret = ThreadLocalRandom.current().nextLong();
}
How Exploit:
Attacker brute-forces weak random secret.
Forges valid authentication cookie.
Presents cookie to bypass login.
Protection from this CVE
Upgrade to Druid 35.0.0.
Explicitly set `druid.auth.authenticator.kerberos.cookieSignatureSecret`.
Use strong, cryptographically random secret.
Impact:
Full cluster compromise.
Unauthorized data access.
Authentication failures in cluster.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
