cbcvebase.
CVE-2021-25646
published 2021-01-29

CVE-2021-25646: Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in…

PriorityP190high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
99.30%
99.9th percentile
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

Affected

2 ranges
VendorProductVersion rangeFixed in
apachedruid<= 0.20.0
apache_software_foundationapache_druid0.20.0 and earlier – 0.20.0

Detection & IOCsextracted from sources · hover to see the quote

url/druid/indexer/v1/sampler
commandfunction(){var hTVCCerYZ = new java.util.Scanner(java.lang.Runtime.getRuntime().exec("/bin/sh`@~-c`@~cat /etc/passwd".split("`@~")).getInputStream()).useDelimiter("\A").next();return {timestamp:"4137368",OQtGXcxBVQVL: hTVCCerYZ}}
  • Detect POST requests to /druid/indexer/v1/sampler with a JSON body containing both a 'format':'javascript' parseSpec and an empty-string key ('') with 'enabled':'true' — this is the exploit's mechanism to bypass the disabled-by-default JavaScript guard.
  • The exploit payload uses an empty JSON key ("") to inject JavaScriptConfig with enabled:true, overriding the server's druid.javascript.enabled=false setting. Alert on any Druid API request body containing the pattern '"":{"enabled":"true"}'.
  • Successful exploitation returns HTTP 200 with a JSON body containing both 'numRowsRead' and 'numRowsIndexed' fields, and a Content-Type of application/json. Use these as response-side detection signals.
  • The vulnerability exists in Apache Druid versions 0.20.0 and earlier (confirmed tested on 0.15.1, 0.16.0, 0.17.1, 0.18.0, 0.19.0, 0.20.0). Monitor for exploitation attempts against any of these versions.
  • The exploit abuses Jackson deserialization: when a JSON key resolves to the empty string "", it binds to the unnamed JavaScriptConfig constructor parameter. Monitor for JSON payloads with empty-string keys in Druid API requests.
  • Publicly available proof-of-concept and a Metasploit module exist for this CVE. Treat any unauthenticated or authenticated POST to /druid/indexer/v1/sampler with a javascript-type parseSpec as high-confidence exploitation attempt.
  • ·JavaScript execution is disabled by default in Apache Druid via the druid.javascript.enabled flag, but this exploit bypasses that control entirely — do not rely on the default-disabled setting as a mitigation for CVE-2021-25646.
  • ·Authentication is not enabled in Apache Druid by default, meaning this RCE is effectively unauthenticated in default deployments. Network-level access controls are the primary compensating control.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vulncheck8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.