CVE-2020-1958: Credentials bypass in Apache Druid
Summary
CVE-2020-1958: Credentials bypass in Apache Druid. Affects org.apache.druid:druid versions >= 0.17.0, < 0.17.1. Fixed in 0.17.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Druid is an open-source distributed data store designed for high-performance analytics. It provides real-time streaming ingestion and querying capabilities, making it suitable for use cases such as time series analysis, event-driven architectures, and data exploration. The vulnerability described in this report affects Apache Druid version 0.17.0.
Vulnerability Detail
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. This means that even if a user does not meet the LDAP user search filter criteria, they can still authenticate with Druid as long as they have valid LDAP credentials. However, they are still subject to role-based authorization checks, if configured. Additionally, callers of Druid APIs can retrieve any LDAP attribute values of users that exist on the LDAP server, as long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.
How To Fix
Minimum fixed version
0.17.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable LDAP authentication in Apache Druid until the upgrade can be performed. This can be done by modifying the Druid configuration to remove the LDAP authentication settings. However, it is important to note that this workaround will remove the LDAP authentication functionality entirely, potentially impacting the security and access control of the system.
Conclusion
In conclusion, the vulnerability in Apache Druid 0.17.0 allows callers with valid LDAP credentials to bypass the credentialsValidator.userSearch filter barrier and authenticate with the system. It also enables the retrieval of LDAP attribute values of users on the LDAP server. To mitigate this vulnerability, it is crucial to upgrade to Apache Druid version 0.17.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.druid:druid →
FAQ
Apache Druid is an open-source distributed data store designed for high-performance analytics. It provides real-time streaming ingestion and querying capabilities.
This vulnerability affects Apache Druid version 0.17.0.
The vulnerability allows callers with valid LDAP credentials to bypass the LDAP user search filter barrier and authenticate with Apache Druid. It also enables the retrieval of LDAP attribute values of users on the LDAP server, if visible to the Druid server.
Yes, callers of Druid APIs are still subject to role-based authorization checks, if configured.
To fix this vulnerability, it is recommended to upgrade to Apache Druid version 0.17.1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.druid:druid.
