| name | druid-vulnerability-patching |
| description | Techniques for identifying and patching vulnerabilities in Apache Druid, specifically focusing on Jackson deserialization and JavaScript security. Use this skill when dealing with CVEs related to RCE or security bypasses in Druid. |
Druid Vulnerability Patching
Jackson Deserialization Security
Apache Druid uses Jackson for JSON deserialization. A common vulnerability is when injected values (via @JacksonInject) can be overridden by user-provided JSON properties.
Preventing Injection Overrides
To prevent a JSON property from overriding an injected value, use the useInput attribute of @JacksonInject set to OptBoolean.FALSE.
Example:
@JsonCreator
public MyObject(
@JsonProperty("prop") String prop,
@JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.FALSE) MyConfig config
)
Identifying Vulnerable Components
Search for all occurrences of @JacksonInject in the codebase, especially those involving configuration classes like JavaScriptConfig, AuthConfig, etc.
grep -r "@JacksonInject" .
JavaScript Security in Druid
Druid has a global configuration to enable/disable JavaScript execution. This is usually managed by JavaScriptConfig.
Security Checks
Always check config.isEnabled() before executing any JavaScript.
if (!config.isEnabled()) {
throw new ISE("JavaScript is disabled");
}
Bypass via Empty Keys
Attackers may use empty keys "" in JSON to target parameters that lack a name during deserialization. Ensuring all constructor parameters have explicit @JsonProperty names or disabling input for @JacksonInject prevents this.
