Druid js vulnerability

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-claude-opus-4-6/fix-security-bug/druid-js-vulnerability

Patching Apache Druid JavaScript injection vulnerability (CVE-2021-25646). Use this skill when fixing Druid's JavaScript execution bypass where empty JSON keys override @JacksonInject JavaScriptConfig to enable JavaScript execution despite being disabled server-wide.From its SKILL.md

Install

npx -y skills add cxcscmu/SkillLearnBench --skill druid-js-vulnerability

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.9 KB, 383 tokens by cl100k_base, as published. Nobody here has run it

Apache Druid JavaScript Injection Vulnerability

Affected Components

All classes that accept @JacksonInject JavaScriptConfig config in their @JsonCreator constructors:

JavaScriptDimFilter — processing module, filter package
JavaScriptExtractionFn — processing module, extraction package
JavaScriptAggregatorFactory — processing module, aggregation package
JavaScriptPostAggregator — processing module, post-aggregation package
JavaScriptParseSpec — core module, data input package

Attack Vector

An authenticated user sends a POST to /druid/indexer/v1/sampler with a JSON body containing:

A JavaScript filter/aggregator/extraction function
An empty key "" with {"enabled": true} to override the injected JavaScriptConfig

This bypasses druid.javascript.enabled = false and allows arbitrary code execution via the Rhino JavaScript engine.

Fix Strategy

Change all @JacksonInject JavaScriptConfig config to:

@JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.NEVER) JavaScriptConfig config

This must be applied to all 5 affected files. The fix is in two modules:

core module: JavaScriptParseSpec
processing module: JavaScriptDimFilter, JavaScriptExtractionFn, JavaScriptAggregatorFactory, JavaScriptPostAggregator

Build Command

cd /root/druid
mvn clean package -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true \
  -Dforbiddenapis.skip=true -Dspotbugs.skip=true -Danimal.sniffer.skip=true \
  -Denforcer.skip=true -Djacoco.skip=true -Ddependency-check.skip=true \
  -pl '!web-console' -pl indexing-service -am

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.