CVE-2021-36749: Apache Druid - Authenticated users can read data from other sources than intended
Summary
CVE-2021-36749: Druid ingestion system Authenticated users can read data from other sources than intended. Affects org.apache.druid:druid-core versions < 0.22.0. Fixed in 0.22.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Druid is an open-source distributed data store designed for high-performance, real-time analytics. It provides a scalable and efficient solution for processing and querying large volumes of data. The vulnerability identified as CVE-2021-36749 affects the Druid ingestion system, specifically the HTTP InputSource. This InputSource allows authenticated users to read data from unintended sources, such as the local file system, with the privileges of the Druid server process. While this vulnerability does not result in an elevation of privilege when accessing Druid directly, it becomes problematic when users interact with Druid indirectly through an application that only allows the HTTP InputSource. In such cases, users can bypass application-level restrictions by passing a file URL to the HTTP InputSource.
Vulnerability Detail
The vulnerability arises from the HTTP InputSource in the Druid ingestion system, which permits authenticated users to read data from unintended sources. By leveraging this vulnerability, an attacker can access data from sources beyond their intended scope, including the local file system. This can lead to unauthorized access to sensitive information and potential data breaches. It is important to note that this vulnerability was previously reported as fixed in versions 0.21.0 and 0.21.1, but it was not effectively addressed until version 0.22.0.
How To Fix
Minimum fixed version
0.22.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can modify their applications to utilize the Local InputSource instead of the HTTP InputSource. By doing so, the application-level restriction remains effective, and users cannot bypass it by passing a file URL. This workaround ensures that only the intended data sources are accessible and mitigates the risk of unauthorized data access.
Conclusion
The vulnerability identified as CVE-2021-36749 in Apache Druid allows authenticated users to read data from unintended sources, potentially leading to unauthorized access and data breaches. To mitigate this vulnerability, it is crucial to upgrade the Apache Druid package to version 0.22.0 or later. Additionally, utilizing the Local InputSource as a temporary workaround can help prevent unauthorized data access. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.druid:druid-core →
FAQ
The vulnerability allows authenticated users to read data from unintended sources, potentially leading to unauthorized access to sensitive information and data breaches.
No, this vulnerability does not result in an elevation of privilege when users access Druid directly. Druid provides the Local InputSource, which allows the same level of access as the HTTP InputSource.
An attacker with authenticated access to Druid can exploit this vulnerability by passing a file URL to the HTTP InputSource, thereby accessing data from unintended sources.
This vulnerability was previously reported as fixed in versions 0.21.0 and 0.21.1. However, it was not effectively addressed until version 0.22.0.
The severity of this vulnerability is rated as MODERATE, with a CVSS score of 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.druid:druid-core.
