CVE-2021-36749: fallo en Apache Druid
Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)
Publicada el · Actualizada el
82Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 81%
de la publicación al arma0 días
Publicada en NVD24 sept
1ª PoC22 may
VulnCheck+177d
probabilidad de explotación
81%top 1% de las CVE
explotación observada
síVulnCheck
3 exploit(s) público(s)
Lo que declaran los fabricantes (VEX)
Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.
Red Hatdocumento VEX ↗
No afectado
1 producto — porque el código vulnerable no está presente en el producto
Red Hat OpenShift Container Platform 4
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
Productos afectados
Apache Software Foundation · Apache DruidPoCs públicas encontradas — 3
vulncheckvulncheck.com/xdb/e4e9ac13414ano verificadovulncheckvulncheck.com/xdb/d9494fbeed7fno verificadovulncheckvulncheck.com/xdb/65e8166e235dno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Apache Druid
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-25646—Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.EPSS 99.0%CVE-2021-26919—Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.EPSS 22.8%CVE-2021-26920—Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intendedEPSS 9.5%CVE-2021-44791—Reflected XSS on certain HTTP endpointsEPSS 2.2%CVE-2022-28889—Clickjacking in the web consoleEPSS 1.9%CVE-2025-27888MEDIUMApache Druid: Server-Side Request Forgery and Cross-Site ScriptingEPSS 1.8%