Run3 apache druid javascript rce vulnerability analysis
[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.
npx -y skills add cxcscmu/SkillLearnBench --skill run3_apache-druid-javascript-rce-vulnerability-analysisAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Understanding the CVE in Apache Druid 0.20.0 where authenticated attackers can execute arbitrary code via JavaScript payloads. The vulnerability exploits @JacksonInject with empty key "" to override JavaScriptConfig and enable JavaScript execution even when disabled. Use this skill to understand the attack vector and plan the fix.
SKILL.md
2.2 KB, 385 tokens by cl100k_base, as published. Nobody here has run it
Vulnerability Overview
Apache Druid 0.20.0 has a Remote Code Execution (RCE) vulnerability through JavaScript filters, transforms, and other JavaScript-enabled features.
Attack Vector
The exploit sends JSON payloads with a "" (empty string) key that maps to the JavaScriptConfig parameter in filter/aggregator constructors. Because Jackson's @JacksonInject annotation defaults to allowing input values to override injected values, an attacker can supply a JavaScriptConfig with enabled: true, bypassing the server's security configuration.
Affected Components
JavaScript-enabled features in Druid that accept JavaScriptConfig via @JacksonInject:
- JavaScriptFilter —
processing/src/main/java/org/apache/druid/query/filter/JavaScriptDimFilter.java - JavaScriptAggregatorFactory —
processing/src/main/java/org/apache/druid/query/aggregation/JavaScriptAggregatorFactory.java - JavaScriptExtractionFn —
processing/src/main/java/org/apache/druid/query/extraction/JavaScriptExtractionFn.java - JavaScriptParseSpec —
processing/src/main/java/org/apache/druid/data/input/impl/JavaScriptParseSpec.java - JavaScriptPostAggregator —
processing/src/main/java/org/apache/druid/query/aggregation/post/JavaScriptPostAggregator.java
Root Cause
The @JacksonInject annotation without useInput = OptBoolean.FALSE allows deserialized JSON input to override the server-side injected JavaScriptConfig. The empty key "" in JSON is used because @JacksonInject without a value attribute uses empty string as the injection key.
Fix Strategy
Change all @JacksonInject annotations on JavaScriptConfig parameters to include useInput = OptBoolean.FALSE, which tells Jackson to never use input JSON to fill this parameter — only the injected server-side value will be used.