#VU56850 Security restrictions bypass in Apache Druid - CVE-2021-36749

Vulnerability identifier: #VU56850

Vulnerability risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2021-36749

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Apache Druid
Server applications / Database software

Vendor: Apache Foundation

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to a design error in the HTTP InputSource method, which allows a remote authenticated user to view contents of local files on the system.

Note, the vulnerability exists due to incomplete fix for #VU54554 (CVE-2021-26920).

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Apache Druid: 0.21.0 - 0.21.1

---

External links
https://seclists.org/oss-sec/2021/q3/186

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.