Skip to content

Access Control: Apache Druid - Remote Code Execution (Apache Log4j)

Identifier: apache_druid_log4j

Scanner(s) Support

GraphQL Scanner REST Scanner WebApp Scanner ASM Scanner

Description

Apache Druid is vulnerable to remote code execution due to Log4j vulnerabilities.

How we test: We test for Log4j remote code execution vulnerabilities in Apache Druid by injecting JNDI lookup payloads and analyzing responses to detect if remote code execution is possible.

Configuration

Example

Example configuration:

---
security_tests:
  apache_druid_log4j:
    skip: false

Reference

skip

Type : boolean

Skip the test if true.