Skill: evo-druid-cve-patch

Purpose

Patches Apache Druid 0.20.0 for CVE-2021-25646 - a JavaScript injection vulnerability where empty-string keys in JSON payloads can override server-side JavaScriptConfig to enable arbitrary code execution.

Vulnerability Summary

• CVE: CVE-2021-25646
• Affected: Apache Druid <= 0.20.0
• Mechanism: Empty key "" in JSON overrides @JacksonInject JavaScriptConfig parameter
• Impact: Authenticated RCE via JavaScript filters/aggregators/extraction functions

Patch Strategy (Two-Layer Defense)

Layer 1: Raw JSON Validation (SamplerResource - Approach 3)

Modify SamplerResource.java to:

1. Accept raw String instead of auto-deserialized SamplerSpec
2. Check for empty-string key pattern (""\s*:) using regex
3. Reject requests containing empty keys with 400 Bad Request
4. Only then deserialize via ObjectMapper.readValue()

Requires injecting @Json ObjectMapper via Guice constructor injection. Return type changes from SamplerResponse to Response for error handling.

Layer 2: Jackson Injection Hardening (Approach 2 - Defense in Depth)

Add @JacksonInject(useInput = OptBoolean.FALSE) to all three JavaScript classes:

• JavaScriptDimFilter (processing module)
• JavaScriptAggregatorFactory (processing module)
• JavaScriptExtractionFn (processing module)

This tells Jackson 2.9+ to never populate the JavaScriptConfig parameter from JSON input.

Affected Files

1. indexing-service/src/main/java/org/apache/druid/indexing/overlord/sampler/SamplerResource.java
2. processing/src/main/java/org/apache/druid/query/filter/JavaScriptDimFilter.java
3. processing/src/main/java/org/apache/druid/query/aggregation/JavaScriptAggregatorFactory.java
4. processing/src/main/java/org/apache/druid/query/extraction/JavaScriptExtractionFn.java

Usage

import sys
sys.path.insert(0, '/app/environment/skills/evo-druid-cve-patch/scripts')
from patch_druid import apply_all_patches, generate_patch_file, run_maven_build

# Apply patches to source
apply_all_patches('/root/druid')

# Generate patch file
generate_patch_file('/root/druid', '/root/patches/fix-cve-2021-25646.patch')

# Build
run_maven_build('/root/druid')

Build Command

export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which javac))))
cd /root/druid
mvn clean package -DskipTests \
  -Dcheckstyle.skip=true -Dpmd.skip=true -Dforbiddenapis.skip=true \
  -Dspotbugs.skip=true -Danimal.sniffer.skip=true -Denforcer.skip=true \
  -Djacoco.skip=true -Ddependency-check.skip=true \
  -pl '!web-console' -pl indexing-service -am \
  > /tmp/mvn-build.log 2>&1

Key Lessons

• Python repr() is useful for generating Java string literals with proper escaping
• The regex pattern ""\s*: matches empty JSON keys
• Java string literal for this pattern: "\"\"\\s*:"
• Always redirect Maven build output to a log file
• Always set JAVA_HOME before running Maven