Druid ingestion system Authenticated users can read data from other sources than intendedGHSA-9p5g-vg43-mj5r
MEDIUMGHSA-9p5g-vg43-mj5r is a medium-severity (CVSS 6.5) CWE-863 vulnerability in org.apache.druid:druid-core. 7 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for org.apache.druid:druid-core — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.apache.druid:druid-coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.apache.druid:druid-core | all versions | 0.22.0org.apache.druid:druid-core:0.22.0 |
Affected Products
druidapacheResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
In the Druid ingestion system, the InputSource is used for reading data …
Report on github.com
Report on github.com
Report on unit42.paloaltonetworks.com
Report on github.com
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.druid:druid-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.apache.druid:druid-core to 0.22.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9p5g-vg43-mj5r is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
How to detect GHSA-9p5g-vg43-mj5r
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-9p5g-vg43-mj5r -u https://target- Template
- Apache Druid - Local File Inclusion
- Severity
- medium
- Impact
- Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the affected system.
- Remediation
- Apply the latest security patches or updates provided by Apache Druid to fix the LFI vulnerability.
Template by ProjectDiscovery nuclei-templates (_0xf4n9x_), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-9p5g-vg43-mj5r in your dependencies?
Find it across Maven, including transitive dependencies.