High severity · published Jan 29, 2021
CVE-2021-25646
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests
8.8
CVSS
99.1%
EPSS
No
On KEV
Description
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.1% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Druid · Apache
through 0.20.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25646
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25646
Exploit
http://packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Command-Execution.html
Mailing List
http://www.openwall.com/lists/oss-security/2021/01/29/6
lists.apache.org
https://lists.apache.org/thread.html/r04fa1ba93599487c95a8497044d37f8c02a439bfcf92b4567bfb7c8f%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r121abe8014d381943b63c60615149d40bde9dc1c868bcee90d0d0848%40%3Ccommits.druid.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c45bdefc32c920b9986b941d8f%40%3Cannounce.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad%40%3Cdev.druid.apache.org%3E
More from Druid
9.8
CVE-2026-23906
Apache Druid: Authentication Bypass via LDAP Anonymous Bind
9.8
CVE-2025-59390
Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.
8.8
CVE-2021-26919
Apache Druid allows users to read data from other database systems using JDBC
6.5
CVE-2024-45537
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
6.5
CVE-2021-36749
In the Druid ingestion system, the InputSource is used for reading data from a certain data source