Druid javascript rce

Skill cxcscmu/SkillLearnBench/skills/b1-one-shot-claude-opus-4-6/fix-security-bug/druid-javascript-rce

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill druid-javascript-rce

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Apache Druid JavaScript RCE vulnerability (CVE-2021-25646) fix via @JacksonInject hardening and constructor validation.

SKILL.md

1.9 KB, 404 tokens by cl100k_base, as published. Nobody here has run it

Apache Druid JavaScript RCE Vulnerability

Overview

Apache Druid 0.20.0 allows authenticated users to execute arbitrary server-side code through JavaScript-based features (filters, aggregators, extraction functions, etc.) even when JavaScript is disabled via druid.javascript.enabled=false.

Root Cause

All JavaScript-related classes use @JacksonInject JavaScriptConfig config to receive the server-side JavaScript configuration. Jackson's default behavior allows JSON input to override injected values via an empty key "".

Affected Classes

JavaScriptDimFilter - processing module
JavaScriptAggregatorFactory - processing module
JavaScriptExtractionFn - processing module
JavaScriptPostAggregator - processing module
JavaScriptParseSpec - core module
JavaScriptTieredBrokerSelectorStrategy - server module (already has constructor check)

Fix Strategy

For each affected class:

Change @JacksonInject to @JacksonInject(useInput = OptBoolean.FALSE)
Add Preconditions.checkState(config.isEnabled(), "JavaScript is disabled") in constructors that don't already have it

Exploit Payload Example

{
  "type": "index",
  "spec": {
    "dataSchema": {
      "transformSpec": {
        "filter": {
          "type": "javascript",
          "dimension": "dim",
          "function": "function(x){java.lang.Runtime.getRuntime().exec('cmd')}",
          "": {"enabled": true}
        }
      }
    }
  }
}

Modules Requiring Rebuild

druid-core (JavaScriptParseSpec)
druid-processing (JavaScriptDimFilter, JavaScriptAggregatorFactory, JavaScriptExtractionFn, JavaScriptPostAggregator)
druid-server (JavaScriptTieredBrokerSelectorStrategy)
druid-indexing-service (sampler endpoint, depends on above)