druid-vulnerability-patching

Druid Vulnerability Patching

Jackson Deserialization Security

Apache Druid uses Jackson for JSON deserialization. A common vulnerability is when injected values (via @JacksonInject) can be overridden by user-provided JSON properties.

Preventing Injection Overrides

To prevent a JSON property from overriding an injected value, use the useInput attribute of @JacksonInject set to OptBoolean.FALSE.

Example:

@JsonCreator
public MyObject(
    @JsonProperty("prop") String prop,
    @JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.FALSE) MyConfig config
)

Identifying Vulnerable Components

Search for all occurrences of @JacksonInject in the codebase, especially those involving configuration classes like JavaScriptConfig, AuthConfig, etc.

grep -r "@JacksonInject" .

JavaScript Security in Druid

Druid has a global configuration to enable/disable JavaScript execution. This is usually managed by JavaScriptConfig.

Security Checks

Always check config.isEnabled() before executing any JavaScript.

if (!config.isEnabled()) {
  throw new ISE("JavaScript is disabled");
}

Bypass via Empty Keys

Attackers may use empty keys "" in JSON to target parameters that lack a name during deserialization. Ensuring all constructor parameters have explicit @JsonProperty names or disabling input for @JacksonInject prevents this.