CVE-2021-25646

Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

published January 29, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.9th percentile for exploit probability.

CVSS
—
EPSS
99%
Percentile
99.9
In the wild
Unconfirmed
What it is

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.99001 · 99.9th percentile
Published
2021-01-29T19:15Z
EPSS history
Timeline
  • 29 JAN 19:15Z
    Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
    cvelistv5