CVE-2021-26920
published 2021-07-02CVE-2021-26920: In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to…
PriorityP274medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
9.88%
95.1th percentile
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | druid | < 0.22.0 | 0.22.0 |
| apache_software_foundation | apache_druid | 0.21.1 and earlier – 0.21.1 | — |
Detection & IOCsextracted from sources · hover to see the quote
url/druid/indexer/v1/sampler?for=connect
pathfile:///etc/passwd
- →Detect POST requests to the Druid sampler endpoint with a 'file://' URI scheme inside the HTTP InputSource 'uris' field, indicating an LFI attempt via the HTTP InputSource bypass.
- →Match response body for Unix passwd file patterns (e.g., 'root:.*:0:0:' or 'druid:*:1000:1000:') to confirm successful local file read via the vulnerability.
- →Flag any HTTP InputSource ingestion request where the 'uris' array contains a 'file://' scheme, as this is the core bypass technique — passing a file URL to the HTTP InputSource to read local files. ↗
- ·The vulnerability is only exploitable by authenticated users; unauthenticated access to the Druid API is required to be blocked at the network/application layer. The fix was incomplete in versions 0.21.0 and 0.21.1. ↗
- ·OpenShift Container Platform deployments of Druid (ose-metering-hive) are not affected because HTTP and HDFS InputSources are not included in that package. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
ghsa6.5MEDIUM
osv6.5MEDIUM
vulncheck6.5MEDIUM
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
druid: HTTP InputSource allows authenticated users to read data from other sources (incomplete fix of CVE-2021-26920)
vendor_redhat·2021-09-23·CVSS 6.5
CVE-2021-36749 [MEDIUM] CWE-200 druid: HTTP InputSource allows authenticated users to read data from other sources (incomplete fix of CVE-2021-26920)
druid: HTTP InputSource allows authenticated users to read data from other sources (incomplete fix of CVE-2021-26920)
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction b
Red Hat
druid: HTTP InputSource allows authenticated users to read data from other sources
vendor_redhat·2021-07-02·CVSS 6.5
CVE-2021-26920 [MEDIUM] CWE-200 druid: HTTP InputSource allows authenticated users to read data from other sources
druid: HTTP InputSource allows authenticated users to read data from other sources
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP In
GHSA
Druid ingestion system Authenticated users can read data from other sources than intended
ghsa·2021-09-27·CVSS 6.5
CVE-2021-36749 [MEDIUM] CWE-668 Druid ingestion system Authenticated users can read data from other sources than intended
Druid ingestion system Authenticated users can read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the
OSV
Druid ingestion system Authenticated users can read data from other sources than intended
osv·2021-09-27·CVSS 6.5
CVE-2021-36749 [MEDIUM] Druid ingestion system Authenticated users can read data from other sources than intended
Druid ingestion system Authenticated users can read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the
GHSA
Druid ingestion system Authenticated users can read data from other sources than intended
ghsa·2021-08-13
CVE-2021-26920 [MEDIUM] CWE-863 Druid ingestion system Authenticated users can read data from other sources than intended
Druid ingestion system Authenticated users can read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the
OSV
Druid ingestion system Authenticated users can read data from other sources than intended
osv·2021-08-13
CVE-2021-26920 [MEDIUM] Druid ingestion system Authenticated users can read data from other sources than intended
Druid ingestion system Authenticated users can read data from other sources than intended
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the
VulnCheck
Apache druid Incorrect Authorization
vulncheck·2021·CVSS 6.5
CVE-2021-36749 [MEDIUM] Apache druid Incorrect Authorization
Apache druid Incorrect Authorization
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned
VulnCheck
Apache druid Externally Controlled Reference to a Resource in Another Sphere
vulncheck·2021·CVSS 6.5
CVE-2021-26920 [MEDIUM] Apache druid Externally Controlled Reference to a Resource in Another Sphere
Apache druid Externally Controlled Reference to a Resource in Another Sphere
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSou
No detection rules found.
Nuclei
Apache Druid - Local File Inclusion
nuclei·CVSS 6.5
CVE-2021-36749 [MEDIUM] Apache Druid - Local File Inclusion
Apache Druid - Local File Inclusion
Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2021/07/02/1http://www.openwall.com/lists/oss-security/2021/09/24/1https://lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6de5c7c40dd92dab7518746fbaa2%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3Ehttp://www.openwall.com/lists/oss-security/2021/07/02/1http://www.openwall.com/lists/oss-security/2021/09/24/1https://lists.apache.org/thread.html/r29e45561343cc5cf7d3290ee0b0e94e565faab19c20d022df9b5e29c%40%3Cdev.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r61aab724cf97d80da7f02d50e9af6de5c7c40dd92dab7518746fbaa2%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3E
2021-07-02
Published
Exploited in the wild