Exploit for CVE-2021-25646

githubexploit · 2021-02-13

Description

Exploit information for CVE-2021-25646 affecting Apache Druid.

Entry point

Parametertype · request body

Path/druid/indexer/v1/sampler

Authenticated attackers can craft a request to enable and execute JavaScript code on the Druid server via the /druid/indexer/v1/sampler endpoint.

Affected Apache Druid versions

Apache Druid≤ 0.20.0

All known vulnerabilities by product

CVSS 9.0 for CVE-2021-25646

9.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

49%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

99.0%higher than 99.9% of all CVEs

Updated 2026-08-25

CVE Information

Exploit Details

Modified:2024-08-12 20:10

Last Seen:2026-07-18 03:52

Reporter:Vulnmachines

Last commit:2021-06-10

Tags

Apache Druidsecurity vulnerabilitysecurity advisory

Other exploits for CVE-2021-25646

RCE-PoC-CVE-2021-25646

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

Apache-Druid-CVE-2021-25646

2026-08-27 KitPloitKITPLOIT

CVE-2021-25646-exp

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2021-25646-GUI

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

Exploit Code

README6 lines

## https://sploitus.com/exploit?id=05540576-A7EF-54DF-906F-E2D55408AD36
# Apache-Druid-CVE-2021-25646

## Youtube

https://www.youtube.com/watch?v=-mdK5HSRiQU