evo-druid-cve-patcher

CVE-2021-25646 Druid Patcher

Problem

Apache Druid 0.20.0 has a vulnerability where Jackson deserialization allows JSON payloads to override @JacksonInject parameters via an empty string key. This lets attackers bypass the druid.javascript.enabled=false security setting and execute arbitrary JavaScript/Java code on the server.

Root Cause

GuiceAnnotationIntrospector extends NopAnnotationIntrospector and only overrides findInjectableValueId(), which returns the Guice injection key but does NOT specify whether JSON input may participate. The newer Jackson 2.9+ method findInjectableValue() returns a JacksonInject.Value that includes a useInput flag. Since GuiceAnnotationIntrospector does not override this method, Jackson defaults to allowing JSON input to supply injected values.

Fix

Override findInjectableValue() in GuiceAnnotationIntrospector to return JacksonInject.Value.construct(id, Boolean.FALSE), which prevents any JSON input from overriding Guice-injected values. This fix covers ALL affected classes (JavaScriptDimFilter, JavaScriptAggregatorFactory, JavaScriptExtractionFn) at the framework level.

Usage

import sys
sys.path.insert(0, '/app/environment/skills/evo-druid-cve-patcher/scripts')
from patch_druid import run_end_to_end, validate

# Run end-to-end: write patch, apply, build, deploy
run_end_to_end(
    druid_src_dir='/root/druid',
    patch_dir='/root/patches',
    druid_lib_dir='/opt/druid/lib',
    build_log='/tmp/mvn-build.log'
)

# Validate the fix
assert validate(
    druid_src_dir='/root/druid',
    patch_dir='/root/patches',
    druid_lib_dir='/opt/druid/lib'
)

Build Notes

• Exclude web-console and indexing-hadoop modules to avoid OOM and missing plugin errors
• Use -o (offline) flag if all dependencies are cached
• Key JARs to deploy: druid-core (contains the fix), druid-processing, druid-server, druid-indexing-service
• Skip code quality checks: checkstyle, pmd, forbiddenapis, spotbugs, animal-sniffer, enforcer, jacoco, dependency-check