Listen to this Post
How the CVE Works:
CVE-2025-27888 exploits Apache Druid’s management proxy via a crafted URL, leading to Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), or Open Redirect vulnerabilities. An attacker can manipulate requests to redirect users to malicious servers, execute scripts in their context, or bypass security controls. Authentication is required, but the management proxy is enabled by default. The flaw stems from improper input validation and URL handling in Druid’s web console.
DailyCVE Form:
Platform: Apache Druid
Version: All prior versions
Vulnerability: SSRF/XSS/Open Redirect
Severity: Medium (5.8 CVSS)
Date: 07/14/2025
Prediction: Patch expected by 08/2025
What Undercode Say:
Analytics:
curl -X GET "http://druid-host/proxy?url=malicious-site" nmap -p 8888 <druid-host> --script druid-ssrf
How Exploit:
- Craft malicious URL via management proxy.
- Trigger XSS via unescaped user input.
- Redirect authenticated users to phishing sites.
Protection from this CVE:
- Disable management proxy if unused.
- Upgrade to Druid 31.0.2/32.0.1.
- Implement strict URL validation.
Impact:
- Data leakage via SSRF.
- Session hijacking via XSS.
- Phishing via Open Redirect.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
