CVE-2025-3790

Executive Summary

CVE-2025-3790 is a critical improper access control vulnerability affecting the Apache Druid Monitoring Console exposed via the /druid/index.html endpoint in Baseweb JSite 1.0. The vulnerability allows unauthenticated remote attackers to access sensitive monitoring interfaces, potentially leading to data exfiltration, configuration manipulation, or further lateral movement within the network. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is currently available, and the vendor’s patch status remains unknown.

Note: This vulnerability is not a flaw in the Apache Druid project itself. It is a misconfiguration or insecure integration within the Baseweb JSite application that exposes the Druid monitoring console without proper authentication.

Supply Chain & Package Security

This vulnerability does not directly affect an NPM, PyPI, Go, or Ruby package. However, the exposure of the Apache Druid monitoring console can lead to supply chain risks if the Druid instance is used to process or store data from third-party packages or services. Organizations using Baseweb JSite 1.0 should audit their dependency on Apache Druid and ensure the monitoring interface is not exposed to untrusted networks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability requires no authentication, no user interaction, and can be exploited remotely with low complexity. Public exploit code is available, increasing the likelihood of widespread attacks.

Deep Dive & Mechanics

The vulnerability resides in the Baseweb JSite 1.0 application, which exposes the Apache Druid monitoring console at the path /druid/index.html. The Druid monitoring console is a web-based interface that provides real-time metrics, query statistics, and administrative controls for Apache Druid clusters. In a secure deployment, this console should be protected by authentication or network restrictions. However, in JSite 1.0, the console is accessible without any access control checks.

Root Cause: The application does not enforce authentication or authorization for the /druid/ path. This allows any unauthenticated user to access the Druid console, view sensitive cluster information, and potentially execute administrative actions if the Druid instance is misconfigured.

Attack Vector: An attacker can send a simple HTTP GET request to http://target/druid/index.html and gain immediate access to the monitoring console. From there, they can:

• View cluster topology, node status, and data source schemas.
• Execute SQL queries against Druid (if the console allows it).
• Access configuration details that may reveal credentials or other sensitive data.
• Potentially exploit other Druid vulnerabilities if the version is outdated.

Impact: Successful exploitation can lead to complete compromise of the Druid cluster, data exfiltration, and lateral movement to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (Baseweb JSite 1.0): The application likely uses a web server (e.g., Tomcat, Jetty) that serves static files without authentication. The vulnerable configuration might look like:

<!-- web.xml or similar configuration exposing Druid console -->
<servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>/druid/*</url-pattern>
</servlet-mapping>

No authentication filter is applied to the /druid/ path.

Patched Code (Hypothetical): A secure implementation would require authentication for the Druid console. For example, using a servlet filter:

// AuthenticationFilter.java
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
    HttpServletRequest req = (HttpServletRequest) request;
    if (req.getRequestURI().startsWith("/druid/")) {
        if (req.getSession().getAttribute("user") == null) {
            ((HttpServletResponse) response).sendError(401, "Unauthorized");
            return;
        }
    }
    chain.doFilter(request, response);
}

Or, in Apache HTTPD or Nginx, restrict access by IP or require authentication:

location /druid/ {
    deny all;
    # or
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Note: Since no official patch exists, the above is a recommended mitigation.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Baseweb JSite 1.0 in a controlled environment (e.g., Docker container).
2. Ensure the Druid monitoring console is accessible at /druid/index.html.
3. Use a tool like curl or a web browser to access the console.

Exploitation Steps:

1. Send a GET request to the vulnerable endpoint:

   curl -v http://target:8080/druid/index.html
   

2. If successful, the response will contain the Druid console HTML.
3. Explore the console to extract information:
   • Navigate to the "Datasources" tab to view data schemas.
   • Use the "SQL" tab to execute arbitrary queries (if enabled).
   • Check the "Configuration" tab for sensitive settings.

Example Exploit (Python):

import requests

target = "http://target:8080"
r = requests.get(f"{target}/druid/index.html")
if r.status_code == 200:
    print("[+] Druid console accessible!")
    print(r.text[:500])  # Print first 500 chars
else:
    print("[-] Access denied")

Blue Team (Defensive)

Detection:

• Monitor HTTP access logs for requests to /druid/ paths from unexpected IPs.
• Alert on successful 200 responses to /druid/index.html from unauthenticated users.
• Use network segmentation to restrict access to the Druid console.

Hunting:

• Search for logs containing "GET /druid/" and 200 status code.
• Check for unusual SQL queries in Druid audit logs (if enabled).

Mitigation:

• Immediately restrict access to the /druid/ path using a reverse proxy or firewall.
• Implement authentication for the Druid console (e.g., HTTP Basic Auth).
• If possible, disable the Druid monitoring console entirely in production.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /druid/index.html or /druid/ from external IPs.
  • Unusual SQL queries in Druid logs (e.g., SELECT * FROM sys.sys_segments).
  • Access to Druid console from IPs not in the allowed list.

• File IOCs:

  • Presence of druid/index.html in web server logs.
  • Unauthorized changes to Druid configuration files.

• Behavioral IOCs:

  • Multiple failed login attempts (if authentication is later added).
  • Unexpected data exports or large query results.

Detection Engineering

YARA Rule

rule CVE_2025_3790_Druid_Console_Access {
    meta:
        description = "Detects HTTP requests to the vulnerable Druid monitoring console"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3790"
    strings:
        $druid_path = "/druid/index.html"
        $druid_console = "Druid Console"
        $druid_title = "<title>Druid"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3790 - Unauthenticated Access to Druid Monitoring Console
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to the Druid monitoring console without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/druid/'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: high
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3790 - Druid Console Unauthenticated Access"; flow:to_server,established; content:"GET"; http_method; content:"/druid/"; http_uri; content:"200"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Use a firewall or reverse proxy to block external access to the /druid/ path. Allow only trusted IPs.
2. Implement Authentication: Add HTTP Basic Auth or OAuth to the Druid console. Example for Nginx:

   location /druid/ {
       auth_basic "Restricted";
       auth_basic_user_file /etc/nginx/.htpasswd;
   }
   

3. Disable Console: If not needed, remove or disable the Druid monitoring console entirely.

Long-Term Fix:

• Apply any official patch from Baseweb or Apache Druid when available.
• Upgrade to a version of JSite that properly secures the Druid console.
• Conduct a security audit of all exposed endpoints.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /druid/ from untrusted sources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert