This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Apache Druid allows authenticated users to read local files via HTTP InputSource. π₯ **Consequences**: Arbitrary file read (e.g., /etc/passwd), data leakage, potential server compromise.β¦
π‘οΈ **Root Cause**: The **HTTP InputSource** in the ingestion system is misconfigured. It allows reading from unintended sources (like local file system) instead of just remote HTTP sources.β¦
π΅οΈ **Action**: Hackers can read **any file** accessible by the Druid server process. π **Data**: Local filesystem data (e.g., /etc/passwd, config files).β¦
π **Threshold**: **Medium**. Requires **Authentication**. βοΈ **Config**: Users must be able to specify the **HTTP InputSource** in the ingestion task. Not direct privilege escalation, but indirect via app interaction.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π£ **Exploit**: **Yes**, public PoCs exist. π **GitHub**: Multiple repos (e.g., BrucessKING, Jun-5heng) provide curl commands and Python scripts. π **Wild Exploitation**: Likely, given simple curl-based PoCs.
Q7How to self-check? (Features/Scanning)
π **Check**: Scan for Apache Druid on port **8888**. π§ͺ **Test**: Send POST request to `/druid/indexer/v1/sampler?for=connect` with HTTP InputSource pointing to `file:///etc/passwd`.β¦
π οΈ **Fix**: Upgrade to version **> 0.21.1**. π’ **Official**: Apache announced the fix in mailing lists (CVE-2021-36749). π **Status**: Incomplete fix of previous CVE, so patch is critical.
Q9What if no patch? (Workaround)
π§ **Workaround**: If no patch, **restrict network access** to Druid ingestion endpoints. π **Auth**: Ensure strong authentication and limit who can submit ingestion tasks.β¦
π₯ **Urgency**: **High**. π **Risk**: Data leakage is severe. π **Priority**: Patch immediately if running <= 0.21.1. π’ **Alert**: Public exploits make this easy to weaponize. Don't ignore!