Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

Vulnerability

Details

The vulnerability resides in Apache Druid's feature that allows execution of user-provided JavaScript code in requests. This feature is disabled by default but in Druid 0.20.0 and earlier, an authenticated user can send a specially-crafted request that overrides this configuration and forces Druid to run the JavaScript, regardless of server settings [1][2].

Exploitation

To exploit, an attacker must have authenticated access to the Druid cluster. They can then craft a request that includes JavaScript code, which the Druid server will execute. The attacker does not need any special privileges other than being a legitimate user [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the Druid server with the privileges of the server process. This can lead to full compromise of the Druid node and potentially the entire cluster.

Mitigation

Users should upgrade to Druid 0.20.1, which fixes the issue. Additionally, network access to Druid cluster machines should be restricted to trusted hosts only [2].