A critical security flaw has been identified in Apache Druid, a popular real-time analytics database, which could allow unauthenticated attackers to achieve RCE. The vulnerability, tracked as CVE-2024-45133, involves an unsafe CVE implementation related to the SnakeYAML library during the processing of data ingestion tasks. According to SANS ISC, the issue specifically affects how Apache Druid handles YAML-based configuration specs when extensions such as the Kafka or Kinesis indexing services are active.
Technical Analysis of CVE-2024-45133
The root cause of CVE-2024-45133 lies in the way Apache Druid’s Overlord service deserializes incoming task specifications. The Overlord is the central process responsible for task locking and managing the assignment of tasks to MiddleManager nodes. When a user (or in this case, an attacker) submits a task spec, the system utilizes the SnakeYAML library to parse the configuration.
Historically, SnakeYAML has been prone to deserialization attacks if not configured to use a restricted set of classes. In this instance, Apache Druid failed to properly implement a SafeConstructor, allowing the library to instantiate arbitrary Java classes. By crafting a specific YAML payload, an attacker can trigger the instantiation of classes that execute system commands, bypassing existing security controls. Because many Druid deployments are configured with internal APIs exposed to the network without sufficient authentication, this vulnerability represents a significant risk for lateral movement within a cloud environment.
How to Detect CVE-2024-45133 Exploit Attempts
Security teams looking to identify potential exploitation should focus on monitoring the Overlord’s logs for unusual task submission patterns. Specifically, look for ingestion specs containing atypical YAML tags or class references (e.g., !!javax.script.ScriptEngineManager). Utilizing a SIEM to correlate these logs with outbound network connections from the Overlord or MiddleManager nodes can help identify active C2 communication. Because the exploit occurs during the ingestion phase, EDR solutions on the host should also be tuned to alert on the Druid process spawning unexpected shell processes or executing curl and wget commands.
YAML Deserialization in Apache Druid Extensions
The vulnerability is particularly potent when specific indexing extensions are enabled. For example, the druid-kafka-indexing-service and druid-kinesis-indexing-service are common targets because they frequently handle complex, structured configuration data that may be exposed to external inputs. If an attacker can reach the Overlord’s /druid/indexer/v1/task endpoint, they can submit a payload that triggers the RCE without needing valid credentials, depending on the cluster’s security configuration.
The CVSS score of 9.8 reflects the high impact on confidentiality, integrity, and availability. Successful exploitation grants the attacker the same permissions as the Druid service user, which often has broad access to data stored in deep storage (like Amazon S3 or HDFS) and metadata databases (like MySQL or PostgreSQL).
Apache Druid 30.0.0 Patch Guidance and Mitigation
The primary recommendation for all affected organizations is a mandatory upgrade. The vulnerability has been resolved in Apache Druid 30.0.0, which transitions the project to a safer version of SnakeYAML and implements strict class allow-listing for deserialization processes.
If an immediate upgrade is not feasible, defenders should consider the following temporary mitigations:
- Network Segmentation: Ensure that the Druid Overlord and Coordinator APIs are not exposed to the public internet and are restricted to trusted internal networks via firewall rules.
- Authentication: Enable and enforce TLS and robust authentication (such as Kerberos or LDAP) for all internal API endpoints to prevent unauthenticated task submission.
- Process Monitoring: Monitor for any IoC related to unexpected child processes originating from the
javaprocess running the Druid services.
Following the MITRE ATT&CK framework, this threat maps to T1190 (Exploit Public-Facing Application) and T1203 (Exploitation for Client Execution). Organizations should prioritize this patch as part of their Zero Trust architecture, ensuring that even internal services are hardened against unauthenticated input.