CVE-2021-25646: apache software foundation apache druid
Vulnerability summary
CVE-2021-25646 is a high (CVSS 9.0) vulnerability in apache software foundation apache druid. EPSS estimates a 99.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 29-01-2021PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.00%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.00% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Apache Druid 0.20.0 Remote Command Execution
exploit/linux/http/apache_druid_js_rce
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Apache1 product
- druid≤ 0.20.0
Apache software foundation1 product
- apache druid≥ 0.20.0 and earlier, ≤ 0.20.0
Org.apache.druid1 product
- druid< 0.20.1
3 vendors · 3 products
References
30 links- www.openwall.com/lists/oss-security/2021/01/29/6Mailing ListX Refsource MLISTWEBThird Party Advisory
Show all 30 references
- packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Command-Execution.htmlX Refsource MISCWEBExploitThird Party AdvisoryVDB Entry
