[MAVEN:GHSA-793H-6F7R-6QVM] Druid ingestion system Authenticated users can read data from other sources than intended

Severity Moderate
Affected Packages 1
Fixed Packages 1
CVEs 1

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.

Package Affected Version
pkg:maven/org.apache.druid/druid-core < 0.21.0
Package Fixed Version
pkg:maven/org.apache.druid/druid-core = 0.21.0
ID
MAVEN:GHSA-793H-6F7R-6QVM
Severity
moderate
URL
https://github.com/advisories/GHSA-793h-6f7r-6qvm
Published
2021-08-13T15:21:50
(3 years ago)
Modified
2023-09-26T13:12:17
(11 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.apache.druid/druid-core org.apache.druid druid-core < 0.21.0
Fixed pkg:maven/org.apache.druid/druid-core org.apache.druid druid-core = 0.21.0
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...