-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability in Apache Druid's Kerberos authenticator stemmed from the use of a cryptographically weak pseudo-random number generator (ThreadLocalRandom) to create a fallback secret for signing authentication cookies when one was not explicitly configured. This weak secret could be predicted or brute-forced by an attacker, allowing them to forge authentication tokens and bypass authentication. The analysis of the provided patches confirms this. The commit c0e355778ce334e804def728fa660bb208f9012a directly addresses this issue. The primary vulnerable function was org.apache.druid.security.kerberos.KerberosAuthenticator.init, where the weak secret was generated. The patch removes this insecure fallback and instead throws an exception. The constructor, org.apache.druid.security.kerberos.KerberosAuthenticator.KerberosAuthenticator, was also modified to enforce the mandatory presence of the cookieSignatureSecret configuration, preventing the insecure code path from ever being reached. Therefore, any runtime profile during an exploit attempt would involve the KerberosAuthenticator class, specifically the init method in the vulnerable version.
org.apache.druid.security.kerberos.KerberosAuthenticator.initextensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java
org.apache.druid.security.kerberos.KerberosAuthenticator.KerberosAuthenticatorextensions-core/druid-kerberos/src/main/java/org/apache/druid/security/kerberos/KerberosAuthenticator.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.druid:druid | maven | < 35.0.0 | 35.0.0 |
JavaJavaOngoing coverage of React2Shell