[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CACZfFK5qhiaNND7Tsf4AKG=Jh9Nk4pHKSLKKCmZS7Au6pEgVqA@mail.gmail.com>
Date: Fri, 29 Jan 2021 09:57:45 -0800
From: Jihoon Son <jihoonson@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-25646: Authenticated users can override system
configurations in their requests which allows them to execute arbitrary code.
Description:
Apache Druid includes the ability to execute user-provided JavaScript
code embedded in various types of requests. This functionality is
intended for use in high-trust environments, and is disabled by
default. However, in Druid 0.20.0 and earlier, it is possible for an
authenticated user to send a specially-crafted request that forces
Druid to run user-provided JavaScript code for that request,
regardless of server configuration. This can be leveraged to execute
code on the target machine with the privileges of the Druid server
process.
Mitigation:
Users should upgrade to Druid 0.20.1. Whenever possible, network
access to cluster machines should be restricted to trusted hosts only.
Credit:
This issue was discovered by Litch1 from the Security Team of Alibaba Cloud.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
