CVE-2025-27888 Scanner

Apache Druid is a high-performance real-time analytics database designed for fast queries on large datasets. It is commonly used by data engineers and analysts in industries like finance, e-commerce, and telecommunications to power dashboards and ad-hoc analytics. Druid ingests streaming and batch data, storing it in a column-oriented format optimized for aggregation and filtering. Its distributed architecture scales horizontally across clusters, handling petabytes of data with sub-second query responses. Organizations rely on Druid for use cases such as clickstream analysis, network monitoring, and fraud detection.

CVE-2025-27888 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Druid. This flaw arises when the management proxy component processes user-supplied URLs without adequate validation. An attacker can craft a malicious request that tricks the Druid server into making HTTP requests to arbitrary destinations. The root cause is insufficient sanitization of input parameters that control the target URL, allowing the server to be used as a proxy to reach internal or external systems.

The vulnerability specifically targets the Druid management proxy endpoint, which is designed to forward requests to other services within the cluster. By manipulating the proxy's URL parameter, an attacker can force the server to send requests to any IP address or domain, including internal network resources like databases, cloud metadata services, or other sensitive systems. The exploit does not require authentication, making it accessible to any attacker who can reach the Druid management interface.

If exploited, this SSRF vulnerability can lead to severe consequences. An attacker could scan internal networks, access confidential data from internal services, or pivot to other systems within the organization's infrastructure. In cloud environments, the attacker might retrieve instance metadata, including credentials, leading to broader compromise. The high CVSS score of 8.9 reflects the potential for significant data breaches and lateral movement within the network.