Code Injection in Apache Druid - CVE-2021-25646
Published: January 29, 2021 / Updated: April 14, 2023
Vulnerability identifier: #VU50166
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-25646
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Apache Druid
watsonx.data
watsonx.data
How to mitigate CVE-2021-25646
Install updates from vendor's website.
Apache Druid - update to 0.20.1
watsonx.data - update to 2.0.2
watsonx.data - update to 2.0.2
Links to Public Exploits and PoC-codes
- Exploit #8985 - CVE-2021-25646 () (April 14, 2023)
- Exploit #7856 - CVE-2021-25646 (CVE-2021-25646 Apache Druid 远程代码执行漏洞 Wker脚本) (May 17, 2022)
- Exploit #7176 - cve-2021-25646 (Apache Druid 远程代码执行;检测脚本) (December 15, 2021)
- Exploit #7135 - CVE-2021-25646 (Apache Druid remote code execution vulnerability - Apache Druid 远程代码执行漏洞利用 CVE-2021-25646) (December 12, 2021)
- Exploit #6741 - CVE-2021-25646-GUI (CSharp CVE-2021-25646-GUI) (September 12, 2021)
- Exploit #5550 - Apache-Druid-CVE-2021-25646 () (June 10, 2021)
- Exploit #5377 - Apache Druid 0.20.0 Remote Command Execution (May 9, 2021)
- Exploit #5225 - PocList (Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-Exchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/RG-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthorized-RCE/TDOA-V11.7-GetOnlineCookie/VMware-vCenter-GetAnyFile/yongy (March 18, 2021)
External References
- http://www.openwall.com/lists/oss-security/2021/01/29/6
- https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c45bdefc32c920b9986b941d8f@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/rc167d5e57f3120578718a7a458ce3e73b3830ac4efbb1b085bd06b92@%3Cdev.druid.apache.org%3E
- https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E