CVE-2025-3790: Jsite Auth Bypass Vulnerability

CVE-2025-3790 Overview

CVE-2025-3790 is an improper access control vulnerability in baseweb JSite 1.0. The flaw resides in the Apache Druid Monitoring Console component, specifically the /druid/index.html endpoint. Unauthenticated remote attackers can reach this interface without proper authorization checks, exposing sensitive database monitoring data. The weakness is classified under [CWE-266: Incorrect Privilege Assignment]. Public disclosure of the exploit technique has occurred, increasing the risk of opportunistic exploitation against exposed JSite instances.

Critical Impact
Remote unauthenticated attackers can access the Apache Druid Monitoring Console on JSite 1.0 deployments, exposing SQL activity, connection pool details, and potentially session identifiers used for further compromise.

Affected Products

baseweb JSite 1.0
Apache Druid Monitoring Console component bundled with JSite
Deployments exposing /druid/index.html to untrusted networks

Discovery Timeline

2025-04-18 - CVE-2025-3790 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3790

Vulnerability Analysis

The vulnerability affects the Apache Druid Monitoring Console shipped with baseweb JSite 1.0. Druid is a JDBC connection pool library for Java applications, and its monitoring console exposes runtime statistics through a web interface at /druid/index.html. JSite 1.0 fails to enforce authentication or authorization on this path. Any network-reachable attacker can browse the console and enumerate SQL statements, active sessions, data sources, connection URIs, and JDBC driver information. The exposure aids reconnaissance for follow-on attacks against the backing database and application logic. Public exploitation instructions have been shared, lowering the barrier to abuse.

Root Cause

The root cause is a missing access control layer around the Druid StatViewServlet. When the console is registered in web.xml or a Spring configuration without the loginUsername, loginPassword, or IP allow-list init parameters, the servlet responds to any request. JSite 1.0 ships with this insecure default, mapping the console under /druid/* without a servlet filter to reject anonymous callers.

Attack Vector

Exploitation requires only network access to the JSite web application. An attacker sends an HTTP GET request to /druid/index.html and receives the rendered console. From there, the attacker navigates to sql.html, session.html, and datasource.html to extract executed SQL statements, user session tokens tied to the JSESSIONID cookie, and JDBC connection strings containing database hostnames and credentials in some configurations. No user interaction is required.

No verified proof-of-concept code is available beyond the URL-based access described in the referenced GitHub write-up and the VulDB entry #305613.

Detection Methods for CVE-2025-3790

Indicators of Compromise

HTTP GET requests to /druid/index.html, /druid/sql.html, /druid/session.html, or /druid/datasource.html from external IP addresses
Successful 200 OK responses to /druid/* paths without a preceding authentication request
User-agent strings associated with reconnaissance tooling accessing the Druid console paths
Unusual session enumeration activity followed by targeted requests reusing captured JSESSIONID values

Detection Strategies

Alert on any anonymous access to the /druid/ URI space in web server or reverse proxy logs
Correlate access to the Druid console with subsequent database queries originating from the same source IP
Baseline internal-only administration paths and flag requests from public network segments

Monitoring Recommendations

Ingest web access logs into a centralized analytics platform and build a rule for /druid/* requests
Monitor JDBC connection metrics for spikes that follow console exposure attempts
Track EPSS trend data for CVE-2025-3790, currently at 0.685% probability, to prioritize response against emerging scanner activity

How to Mitigate CVE-2025-3790

Immediate Actions Required

Block external access to /druid/* at the reverse proxy or WAF until authentication is configured
Configure the Druid StatViewServlet with loginUsername and loginPassword init parameters
Restrict access with the allow init parameter set to trusted management IP ranges
Rotate any database credentials that may have been exposed through the console

Patch Information

No vendor patch has been published for baseweb JSite 1.0 in the referenced advisories. Upgrade guidance is not available in the VulDB submission #554572. Operators should apply configuration hardening and monitor the vendor for a fixed release.

Workarounds

Add a servlet filter that requires authentication before reaching the Druid StatViewServlet
Deploy the JSite application behind a VPN or bastion host, removing direct internet exposure
Set the Druid console to disabled by removing the servlet mapping in web.xml if monitoring is not required
Enforce IP allow-listing on the reverse proxy for the /druid/ path

bash

# Example nginx reverse proxy hardening for the Druid console
location /druid/ {
    allow 10.0.0.0/8;      # internal management network
    allow 192.168.10.0/24; # ops jump hosts
    deny all;
    auth_basic "JSite Druid Console";
    auth_basic_user_file /etc/nginx/.druid_htpasswd;
    proxy_pass http://jsite_backend;
}