Run2 druid cve 2021 25646

Apache Druid CVE-2021-25646: JavaScript RCE Fix

Vulnerability Summary

Authenticated users can execute arbitrary server-side JavaScript through Druid's /druid/indexer/v1/sampler endpoint (and other endpoints accepting JavaScript components) by bypassing the druid.javascript.enabled=false security setting. The bypass uses an empty JSON key "" to override the @JacksonInject JavaScriptConfig with {"enabled": true}.

All 7 Affected Files (MUST patch all)

#	File	Module
1	processing/src/main/java/org/apache/druid/query/filter/JavaScriptDimFilter.java	processing
2	processing/src/main/java/org/apache/druid/query/aggregation/JavaScriptAggregatorFactory.java	processing
3	processing/src/main/java/org/apache/druid/query/aggregation/post/JavaScriptPostAggregator.java	processing
4	processing/src/main/java/org/apache/druid/query/extraction/JavaScriptExtractionFn.java	processing
5	core/src/main/java/org/apache/druid/data/input/impl/JavaScriptParseSpec.java	core
6	server/src/main/java/org/apache/druid/server/router/JavaScriptTieredBrokerSelectorStrategy.java	server
7	indexing-service/src/main/java/org/apache/druid/indexing/overlord/setup/JavaScriptWorkerSelectStrategy.java	indexing-service

Fix Per File (two changes each)

1. Add Import

import com.fasterxml.jackson.annotation.OptBoolean;

2. Change Annotation

// From:
@JacksonInject JavaScriptConfig config
// To:
@JacksonInject(useInput = OptBoolean.FALSE) JavaScriptConfig config

Verification

After patching and deploying:

• Exploit requests with "": {"enabled": true} should be rejected (JavaScript remains disabled)
• Legitimate requests without JavaScript should continue working normally
• If druid.javascript.enabled=true is explicitly set server-side, JavaScript should still work

Build Command

cd /root/druid
mvn clean package -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true \
  -Dforbiddenapis.skip=true -Dspotbugs.skip=true -Danimal.sniffer.skip=true \
  -Denforcer.skip=true -Djacoco.skip=true -Ddependency-check.skip=true \
  -pl '!web-console' -pl indexing-service -am

Key Built Artifacts

• core/target/druid-core-0.20.0.jar
• processing/target/druid-processing-0.20.0.jar
• server/target/druid-server-0.20.0.jar
• indexing-service/target/druid-indexing-service-0.20.0.jar