Exploit for CVE-2021-25646

githubexploit · 2021-02-04

Description

Vulnerability in Apache Druid, CVE-2021-25646 GUI, C# demo code, exploit

Entry point

Parametertype · request body

Path/druid/indexer/v1/sampler

Authenticated attackers can craft a request to enable and execute JavaScript code on the Druid server via the /druid/indexer/v1/sampler endpoint.

Affected Apache Druid versions

Apache Druid≤ 0.20.0

All known vulnerabilities by product

CVSS 9.0 for CVE-2021-25646

9.0

HIGH SEVERITY

Version 2.0

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

97%confidence this exploit runs

Based on 9 file(s) in the source

EPSS Score

99.0%higher than 99.9% of all CVEs

Updated 2026-08-25

CVE Information

Exploit Details

Modified:2021-09-09 06:48

Last Seen:2025-08-31 20:53

Reporter:AirEvan

Written in:C#

Last commit:2021-02-05

Tags

apache druidvulnerabilityCVE-2021-25646guic# demoexploit

Other exploits for CVE-2021-25646

RCE-PoC-CVE-2021-25646

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

Apache-Druid-CVE-2021-25646

2026-08-27 KitPloitKITPLOIT

CVE-2021-25646-exp

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2021-25646-GUI

2026-08-26 KitPloitKITPLOIT

2026-08-26 KitPloitKITPLOIT

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=AB767826-96D0-59A5-8589-55AACA694FBA
# CVE-2021-25646-GUI  
A small `demo` implemented using the `C#` language; some code implementations are referenced from the internet. ![](https://raw.githubusercontent.com/AirEvan/CVE-2021-25646-GUI/main/poc.png)