apache-druid-javascript-rce-vulnerability-analysis
Understanding the CVE in Apache Druid 0.20.0 where authenticated attackers can execute arbitrary code via JavaScript payloads. The vulnerability exploits @JacksonInject with empty key "" to override JavaScriptConfig and enable JavaScript execution even when disabled. Use this skill to understand the attack vector and plan the fix.
- License 许可
- MIT
- 最近更新
- 2026-10-02
- Stars
- ★ 93
- Forks
- 8
01 前言 Front Matter
- name
- apache-druid-javascript-rce-vulnerability-analysis
- description
- Understanding the CVE in Apache Druid 0.20.0 where authenticated attackers can execute arbitrary code via JavaScript payloads. The vulnerability exploits @JacksonInject with empty key "" to override JavaScriptConfig and enable JavaScript execution even when disabled. Use this skill to understand the attack vector and plan the fix.
03 SKILL.md 正文
Vulnerability Overview
Apache Druid 0.20.0 has a Remote Code Execution (RCE) vulnerability through JavaScript filters, transforms, and other JavaScript-enabled features.
Attack Vector
The exploit sends JSON payloads with a "" (empty string) key that maps to the JavaScriptConfig parameter in filter/aggregator constructors. Because Jackson's @JacksonInject annotation defaults to allowing input values to override injected values, an attacker can supply a JavaScriptConfig with enabled: true, bypassing the server's security configuration.
Affected Components
JavaScript-enabled features in Druid that accept JavaScriptConfig via @JacksonInject:
- JavaScriptFilter —
processing/src/main/java/org/apache/druid/query/filter/JavaScriptDimFilter.java - JavaScriptAggregatorFactory —
processing/src/main/java/org/apache/druid/query/aggregation/JavaScriptAggregatorFactory.java - JavaScriptExtractionFn —
processing/src/main/java/org/apache/druid/query/extraction/JavaScriptExtractionFn.java - JavaScriptParseSpec —
processing/src/main/java/org/apache/druid/data/input/impl/JavaScriptParseSpec.java - JavaScriptPostAggregator —
processing/src/main/java/org/apache/druid/query/aggregation/post/JavaScriptPostAggregator.java
Root Cause
The @JacksonInject annotation without useInput = OptBoolean.FALSE allows deserialized JSON input to override the server-side injected JavaScriptConfig. The empty key "" in JSON is used because @JacksonInject without a value attribute uses empty string as the injection key.
Fix Strategy
Change all @JacksonInject annotations on JavaScriptConfig parameters to include useInput = OptBoolean.FALSE, which tells Jackson to never use input JSON to fill this parameter — only the injected server-side value will be used.
04 同仓库更多 Skills
object_counter
Count occurrences of an object in the image using computer vision algorithm.
travel-planning-workflow
Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.
bundled-dataset-search-tool
invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.
glm-output
Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final /root/metrics.json.
glm-calibration
Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.
glm-basics
A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.