Executive Summary

Apache Druid's Kerberos authenticator uses a weak fallback secret when the configuration 'druid.auth.authenticator.kerberos.cookieSignatureSecret' is not explicitly set. This fallback secret is generated using ThreadLocalRandom, which is not cryptographically secure. As a result, an attacker may be able to predict or brute force the secret used to sign authentication cookies, potentially allowing token forgery or authentication bypass. Additionally, each process generates its own fallback secret, causing inconsistent secrets across nodes and leading to authentication failures in distributed or multi-broker deployments.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to predict or brute force the secret used to sign authentication cookies, which may enable token forgery or authentication bypass. In distributed or multi-broker deployments, inconsistent fallback secrets across nodes can cause authentication failures, effectively leading to incorrectly configured clusters and potential denial of service or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should explicitly configure a strong value for the 'druid.auth.authenticator.kerberos.cookieSignatureSecret' in your Apache Druid configuration. Additionally, upgrade Apache Druid to version 35.0.0 or later, where setting this secret is mandatory and the issue is fixed. Note that services will fail to start if the secret is not set in the fixed version, ensuring proper configuration.

Useful 0 Not Useful 0