druid-js-vulnerability

name	druid-js-vulnerability
description	Patching Apache Druid JavaScript injection vulnerability (CVE-2021-25646). Use this skill when fixing Druid's JavaScript execution bypass where empty JSON keys override @JacksonInject JavaScriptConfig to enable JavaScript execution despite being disabled server-wide.

Apache Druid JavaScript Injection Vulnerability

Affected Components

All classes that accept @JacksonInject JavaScriptConfig config in their @JsonCreator constructors:

1. JavaScriptDimFilter — processing module, filter package
2. JavaScriptExtractionFn — processing module, extraction package
3. JavaScriptAggregatorFactory — processing module, aggregation package
4. JavaScriptPostAggregator — processing module, post-aggregation package
5. JavaScriptParseSpec — core module, data input package

Attack Vector

An authenticated user sends a POST to /druid/indexer/v1/sampler with a JSON body containing:

• A JavaScript filter/aggregator/extraction function
• An empty key "" with {"enabled": true} to override the injected JavaScriptConfig

This bypasses druid.javascript.enabled = false and allows arbitrary code execution via the Rhino JavaScript engine.

Fix Strategy

Change all @JacksonInject JavaScriptConfig config to:

@JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.NEVER) JavaScriptConfig config

This must be applied to all 5 affected files. The fix is in two modules:

• core module: JavaScriptParseSpec
• processing module: JavaScriptDimFilter, JavaScriptExtractionFn, JavaScriptAggregatorFactory, JavaScriptPostAggregator

Build Command

cd /root/druid
mvn clean package -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true \
  -Dforbiddenapis.skip=true -Dspotbugs.skip=true -Danimal.sniffer.skip=true \
  -Denforcer.skip=true -Djacoco.skip=true -Ddependency-check.skip=true \
  -pl '!web-console' -pl indexing-service -am