CVE-2022-28889: Apache Druid clickjacking vulnerability
Summary
CVE-2022-28889: Apache Druid before 0.23.0 vulnerable to clickjacking. Affects org.apache.druid:druid versions < 0.23.0. Fixed in 0.23.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Druid is an open-source distributed data store designed for high-performance analytics. It provides real-time analytics and data exploration capabilities. The vulnerability identified as CVE-2022-28889 affects Apache Druid versions 0.22.1 and earlier. These versions do not set appropriate headers to prevent clickjacking attacks. Clickjacking is a technique where an attacker tricks a user into clicking on a malicious element on a webpage, potentially leading to unauthorized actions or data leakage. This vulnerability exposes users of Apache Druid to the risk of clickjacking attacks.
Vulnerability Detail
The vulnerability in Apache Druid versions 0.22.1 and earlier arises from the absence of proper headers to mitigate clickjacking. Without the necessary security headers, an attacker can embed the Apache Druid application within a malicious website or frame, tricking users into interacting with the application unknowingly. This can lead to unintended actions, such as unauthorized data access or manipulation. The impact of a successful clickjacking attack depends on the specific actions allowed by the targeted Apache Druid instance. However, it can potentially result in data breaches, unauthorized access, or other security compromises.
How To Fix
Minimum fixed version
0.23.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to Apache Druid version 0.23.0 or later.
Conclusion
The clickjacking vulnerability in Apache Druid versions 0.22.1 and earlier can be mitigated by upgrading to version 0.23.0 or later. By implementing the Content-Security-Policy header, Apache Druid prevents clickjacking attacks and ensures the security of the application. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.druid:druid →
FAQ
Clickjacking is a technique where an attacker tricks a user into clicking on a malicious element on a webpage, potentially leading to unauthorized actions or data leakage.
The impact of the Apache Druid clickjacking vulnerability depends on the specific actions allowed by the targeted Apache Druid instance. However, it can potentially result in data breaches, unauthorized access, or other security compromises.
Apache Druid versions 0.22.1 and earlier are affected by the clickjacking vulnerability.
To fix the clickjacking vulnerability, it is recommended to upgrade to Apache Druid version 0.23.0 or later. This version includes the necessary security headers to prevent clickjacking attacks.
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to Apache Druid version 0.23.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.druid:druid.
