druid-vulnerability-patching

name	druid-vulnerability-patching
description	Techniques for identifying and patching vulnerabilities in Apache Druid, specifically focusing on Jackson deserialization and JavaScript security. Use this skill when dealing with CVEs related to RCE or security bypasses in Druid.

Druid Vulnerability Patching

Jackson Deserialization Security

Apache Druid uses Jackson for JSON deserialization. A common vulnerability is when injected values (via @JacksonInject) can be overridden by user-provided JSON properties.

Preventing Injection Overrides

To prevent a JSON property from overriding an injected value, use the useInput attribute of @JacksonInject set to OptBoolean.FALSE.

Example:

@JsonCreator
public MyObject(
    @JsonProperty("prop") String prop,
    @JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.FALSE) MyConfig config
)

Identifying Vulnerable Components

Search for all occurrences of @JacksonInject in the codebase, especially those involving configuration classes like JavaScriptConfig, AuthConfig, etc.

grep -r "@JacksonInject" .

JavaScript Security in Druid

Druid has a global configuration to enable/disable JavaScript execution. This is usually managed by JavaScriptConfig.

Security Checks

Always check config.isEnabled() before executing any JavaScript.

if (!config.isEnabled()) {
  throw new ISE("JavaScript is disabled");
}

Bypass via Empty Keys

Attackers may use empty keys "" in JSON to target parameters that lack a name during deserialization. Ensuring all constructor parameters have explicit @JsonProperty names or disabling input for @JacksonInject prevents this.