Run2 druid cve 2021 25646

Skill cxcscmu/SkillLearnBench/skills/b2-self-feedback-claude-opus-4-6/fix-security-bug/run2_druid-cve-2021-25646

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill run2_druid-cve-2021-25646

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Complete fix for Apache Druid CVE-2021-25646 JavaScript RCE via @JacksonInject override in all 7 affected components.

SKILL.md

2.5 KB, as published. Nobody here has run it

Apache Druid CVE-2021-25646: JavaScript RCE Fix

Vulnerability Summary

Authenticated users can execute arbitrary server-side JavaScript through Druid's /druid/indexer/v1/sampler endpoint (and other endpoints accepting JavaScript components) by bypassing the druid.javascript.enabled=false security setting. The bypass uses an empty JSON key "" to override the @JacksonInject JavaScriptConfig with {"enabled": true}.

All 7 Affected Files (MUST patch all)

#	File	Module
1	`processing/src/main/java/org/apache/druid/query/filter/JavaScriptDimFilter.java`	processing
2	`processing/src/main/java/org/apache/druid/query/aggregation/JavaScriptAggregatorFactory.java`	processing
3	`processing/src/main/java/org/apache/druid/query/aggregation/post/JavaScriptPostAggregator.java`	processing
4	`processing/src/main/java/org/apache/druid/query/extraction/JavaScriptExtractionFn.java`	processing
5	`core/src/main/java/org/apache/druid/data/input/impl/JavaScriptParseSpec.java`	core
6	`server/src/main/java/org/apache/druid/server/router/JavaScriptTieredBrokerSelectorStrategy.java`	server
7	`indexing-service/src/main/java/org/apache/druid/indexing/overlord/setup/JavaScriptWorkerSelectStrategy.java`	indexing-service

Fix Per File (two changes each)

1. Add Import

import com.fasterxml.jackson.annotation.OptBoolean;

2. Change Annotation

// From:
@JacksonInject JavaScriptConfig config
// To:
@JacksonInject(useInput = OptBoolean.FALSE) JavaScriptConfig config

Verification

After patching and deploying:

Exploit requests with "": {"enabled": true} should be rejected (JavaScript remains disabled)
Legitimate requests without JavaScript should continue working normally
If druid.javascript.enabled=true is explicitly set server-side, JavaScript should still work

Build Command

cd /root/druid
mvn clean package -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true \
  -Dforbiddenapis.skip=true -Dspotbugs.skip=true -Danimal.sniffer.skip=true \
  -Denforcer.skip=true -Djacoco.skip=true -Ddependency-check.skip=true \
  -pl '!web-console' -pl indexing-service -am

Key Built Artifacts

core/target/druid-core-0.20.0.jar
processing/target/druid-processing-0.20.0.jar
server/target/druid-server-0.20.0.jar
indexing-service/target/druid-indexing-service-0.20.0.jar