CVE-2021-36749: Apache Druid Auth Bypass Vulnerability

CVE-2021-36749 Overview

CVE-2021-36749 is an authorization bypass vulnerability in Apache Druid's ingestion system that allows authenticated users to read arbitrary files from the local file system. The HTTP InputSource component, designed for reading data from external HTTP sources, can be abused by passing file:// URLs instead of legitimate HTTP URLs. This enables attackers to access sensitive files with the privileges of the Druid server process, potentially exposing configuration files, credentials, and other sensitive data stored on the server.

Critical Impact

Authenticated attackers can bypass application-level access controls to read arbitrary files from the Druid server's local file system, potentially exposing sensitive configuration data, credentials, and other confidential information.

Affected Products

• Apache Druid versions prior to 0.22.0
• Apache Druid 0.21.0 (incomplete fix from CVE-2021-26920)
• Apache Druid 0.21.1 (incomplete fix from CVE-2021-26920)

Discovery Timeline

• 2021-09-24 - CVE-2021-36749 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-36749

Vulnerability Analysis

This vulnerability represents an incomplete fix for the previously disclosed CVE-2021-26920. Apache Druid's ingestion system uses various InputSource implementations to read data during the ingestion process. While the Local InputSource provides direct file system access (a legitimate feature for users with direct Druid access), the HTTP InputSource was intended exclusively for fetching data from remote HTTP/HTTPS endpoints.

The vulnerability exists because the HTTP InputSource fails to properly validate and restrict the URL schemes it accepts. When an authenticated user submits an ingestion task with a file:// URL scheme to the HTTP InputSource, the system processes it as a valid request and reads the specified local file. This becomes particularly problematic in deployment architectures where applications act as intermediaries between users and Druid, intentionally restricting access to the Local InputSource while permitting the HTTP InputSource.

Root Cause

The root cause is improper authorization (CWE-863) in the HTTP InputSource component. The vulnerability stems from insufficient URL scheme validation that allows the file:// protocol to be processed when only http:// and https:// schemes should be accepted. This creates a security boundary bypass where application-level restrictions on local file access can be circumvented by using the HTTP InputSource as an indirect access mechanism.

Attack Vector

The attack requires network access and authentication to the Druid cluster. An attacker must be able to submit ingestion tasks, either directly to Druid or through an intermediary application that exposes the HTTP InputSource functionality. The attack is executed by crafting an ingestion specification that uses the HTTP InputSource with a file:// URL pointing to a target file on the server's file system.

The exploitation flow involves an authenticated user submitting a data ingestion request that specifies the HTTP InputSource type but provides a local file path using the file:// URL scheme. The Druid server processes this request without proper scheme validation, reads the local file with server process privileges, and returns the contents to the attacker. This allows reading of any file accessible to the Druid process, including configuration files that may contain database credentials, API keys, or other sensitive information.

Detection Methods for CVE-2021-36749

Indicators of Compromise

• Ingestion task submissions containing file:// URL schemes in HTTP InputSource configurations
• Unusual file access patterns from the Druid server process to sensitive system files
• Ingestion requests targeting common sensitive files such as /etc/passwd, /etc/shadow, or application configuration files
• Repeated failed or successful attempts to access files outside normal data directories

Detection Strategies

• Monitor Druid ingestion task logs for HTTP InputSource requests containing non-HTTP URL schemes
• Implement network-level inspection for ingestion API calls with suspicious URL patterns
• Configure file integrity monitoring on sensitive system files to detect unauthorized read access
• Review Druid audit logs for unusual ingestion task patterns from specific users

Monitoring Recommendations

• Enable comprehensive logging for all ingestion task submissions including full InputSource configurations
• Implement alerting on any ingestion request containing file://, ftp://, or other non-HTTP URL schemes
• Monitor process file access using system auditing tools like auditd to track Druid process file reads
• Establish baseline ingestion patterns and alert on anomalous activity

How to Mitigate CVE-2021-36749

Immediate Actions Required

• Upgrade Apache Druid to version 0.22.0 or later which contains the complete fix for this vulnerability
• Review and restrict which users have permission to submit ingestion tasks
• Implement network segmentation to limit which systems can communicate with Druid ingestion endpoints
• Audit recent ingestion tasks for evidence of exploitation attempts

Patch Information

Apache has addressed this vulnerability in Druid version 0.22.0. This release includes proper URL scheme validation in the HTTP InputSource to reject non-HTTP/HTTPS protocols. Organizations should note that versions 0.21.0 and 0.21.1 do not contain a complete fix despite earlier claims in CVE-2021-26920. For detailed patch information, refer to the Apache Druid Dev Thread and Apache Announcements Thread.

Workarounds

• Implement a reverse proxy or API gateway in front of Druid that inspects and blocks ingestion requests containing file:// URLs
• Restrict ingestion task submission to trusted administrative users only using Druid's authentication and authorization features
• Run the Druid server process with minimal file system permissions using principle of least privilege
• Deploy application-level input validation to reject ingestion specifications with non-HTTP URL schemes before they reach Druid

# Example: Configure Druid with restricted process permissions
# Create dedicated druid user with minimal privileges
useradd -r -s /bin/false druid

# Restrict druid process to specific directories
chown -R druid:druid /opt/druid/var
chmod 700 /opt/druid/var

# Run Druid with the restricted user
sudo -u druid /opt/druid/bin/start-micro-quickstart