CVE-2021-25646 Scanner

CVE-2021-25646 scanner - Code Injection vulnerability in Apache Druid

Short Info

Level

High

Single Scan

Can be used by

Asset Owner

Estimated Time

30 seconds

Time Interval

4 weeks

Scan only one

URL

Toolbox

-

Apache Druid is a data store that was built to meet the needs of large-scale, real-time analytics. It allows users to manage data sets in a distributed and scalable way, providing fast querying and analysis capabilities. The platform is used by businesses across various industries to support real-time data ingestion and queries, operational monitoring, and machine learning use cases.

However, recently, a security vulnerability has been detected in the platform, known as CVE-2021-25646. This vulnerability makes it possible for any authenticated user to send a specially crafted request that forces Druid to execute user-provided JavaScript code for that request, regardless of server configuration. As a result, an attacker can exploit this vulnerability to execute code on the target server with the privileges of the Druid server process, which can lead to a range of malicious activities.

When this vulnerability is exploited, an attacker can gain access to sensitive data, including user credentials and intellectual property. They can install malware or ransomware on the server and take control of the system. Furthermore, they can use the compromised server to launch attacks on other systems, escalating the severity of the breach and causing significant harm to the organization.

Thanks to the pro features of the s4e.io platform, those who read this article can easily and quickly learn about vulnerabilities in their digital assets. The website provides comprehensive vulnerability scanning and management to help organizations stay on top of cyber threats. By using the platform, businesses can ensure that their systems remain secure and are protected against the latest threats.

REFERENCES

Get started to protecting your Free Full Security Scan

Start trial See the plans