CVE-2025-27888: Apache Druid SSRF Vulnerability

CVE-2025-27888 Overview

CVE-2025-27888 is a combined Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), and Open Redirect vulnerability in Apache Druid. The flaw resides in the Druid management proxy, which is enabled by default in the out-of-box configuration. An authenticated attacker can craft a URL that causes the management proxy to redirect the request to an arbitrary server. This behavior enables XSS and Cross-Site Request Forgery (XSRF) attacks against Druid users. The issue affects all Druid versions prior to 31.0.2 and 32.0.1. Apache assigns CWE-79 to this vulnerability.

Critical Impact
Authenticated attackers can leverage the management proxy to redirect requests to attacker-controlled servers, enabling XSS and XSRF against Druid console users.

Affected Products

Apache Druid versions prior to 31.0.2
Apache Druid versions prior to 32.0.1
All previous Druid releases with the management proxy enabled

Discovery Timeline

2025-03-20 - CVE-2025-27888 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27888

Vulnerability Analysis

Apache Druid ships with a management proxy component that forwards requests between the web console and internal Druid services. The proxy accepts URLs that specify the downstream target. When the URL is specially crafted, the proxy forwards the request to an arbitrary external server instead of a legitimate Druid node. The response returned by the attacker-controlled server is delivered to the authenticated user's browser in the trusted context of the Druid console. This gives an attacker three attack primitives: SSRF from the Druid host, reflected XSS in the console, and Open Redirect that can be chained into XSRF against authenticated administrators.

Root Cause

The management proxy performs insufficient validation of the destination URL supplied in incoming requests. Neutralization of untrusted input before response generation is also incomplete, matching the CWE-79 classification. Because the proxy is enabled by default, every stock Druid deployment exposes the sink until upgraded or reconfigured.

Attack Vector

Exploitation requires the attacker to be authenticated to Druid and requires user interaction, typically clicking a crafted link. The attacker crafts a URL that traverses the management proxy but resolves to an external host under their control. When a Druid user follows the link, their browser executes the returned content in the Druid origin, or is silently redirected to attacker infrastructure. See the Apache mailing list advisory and the Openwall OSS-Security discussion for advisory details. No public proof-of-concept has been released, and the EPSS probability sits at approximately 1.73%.

Detection Methods for CVE-2025-27888

Indicators of Compromise

Requests to the Druid management proxy containing external hostnames or unusual URL encoding in the target path.
Outbound HTTP connections from Druid coordinator or router nodes to unexpected destinations.
Console referer chains that terminate at non-Druid domains following an authenticated session.

Detection Strategies

Inspect Druid router and coordinator access logs for proxy paths that carry absolute URLs pointing outside the Druid cluster.
Alert on HTTP 3xx responses from the management proxy endpoint that redirect to external origins.
Correlate authenticated Druid sessions with anomalous outbound connections from Druid service hosts.

Monitoring Recommendations

Forward Druid HTTP access logs to a centralized logging pipeline and retain them for post-incident review.
Monitor egress traffic from Druid nodes and baseline expected destinations to detect SSRF activity.
Track console user activity for redirects immediately preceded by clicks on externally sourced links.

How to Mitigate CVE-2025-27888

Immediate Actions Required

Upgrade Apache Druid to 31.0.2 or 32.0.1, which contain the vendor fix.
Audit all Druid deployments for the presence of the management proxy in default configuration.
Review authentication and role assignments to reduce the pool of users who could trigger the exploit.

Patch Information

Apache released fixed builds in Druid 31.0.2 and Druid 32.0.1. Upgrade instructions and release notes are available through the Apache Druid advisory thread. Operators running earlier major versions should plan migration to a supported branch that includes the fix.

Workarounds

Disable the Druid management proxy if upgrading is not immediately possible; core query functionality remains unaffected.
Restrict console access to trusted networks using firewall rules or a reverse proxy with strict URL allowlisting.
Enforce strong authentication and session controls to limit the population of users who satisfy the authenticated precondition.

bash

# Disable the Druid management proxy in common.runtime.properties
druid.router.managementProxy.enabled=false