Apache Druid JavaScript RCE Vulnerability

Overview

Apache Druid 0.20.0 allows authenticated users to execute arbitrary server-side code through JavaScript-based features (filters, aggregators, extraction functions, etc.) even when JavaScript is disabled via druid.javascript.enabled=false.

Root Cause

All JavaScript-related classes use @JacksonInject JavaScriptConfig config to receive the server-side JavaScript configuration. Jackson's default behavior allows JSON input to override injected values via an empty key "".

Affected Classes

1. JavaScriptDimFilter - processing module
2. JavaScriptAggregatorFactory - processing module
3. JavaScriptExtractionFn - processing module
4. JavaScriptPostAggregator - processing module
5. JavaScriptParseSpec - core module
6. JavaScriptTieredBrokerSelectorStrategy - server module (already has constructor check)

Fix Strategy

For each affected class:

1. Change @JacksonInject to @JacksonInject(useInput = OptBoolean.FALSE)
2. Add Preconditions.checkState(config.isEnabled(), "JavaScript is disabled") in constructors that don't already have it

Exploit Payload Example

{
  "type": "index",
  "spec": {
    "dataSchema": {
      "transformSpec": {
        "filter": {
          "type": "javascript",
          "dimension": "dim",
          "function": "function(x){java.lang.Runtime.getRuntime().exec('cmd')}",
          "": {"enabled": true}
        }
      }
    }
  }
}

Modules Requiring Rebuild

• druid-core (JavaScriptParseSpec)
• druid-processing (JavaScriptDimFilter, JavaScriptAggregatorFactory, JavaScriptExtractionFn, JavaScriptPostAggregator)
• druid-server (JavaScriptTieredBrokerSelectorStrategy)
• druid-indexing-service (sampler endpoint, depends on above)