skadiscarlet opened a new issue, #20665: URL: https://github.com/apache/druid/issues/20665
## Summary The default unauthenticated Druid Router `POST /druid/v2/sql/` path materializes attacker-controlled SQL request bodies before processing. In the 1 GiB Router heap retest, one 512 MiB `text/plain` body triggered `OutOfMemoryError: Java heap space` and terminated the Router. ## Affected Project | Field | Value | | --- | --- | | Project | `apache/druid` | | Entry | `POST /druid/v2/sql/ on Druid Router HTTP port 8888` | | Required privilege | anonymous | | Suggested CVSS 3.1 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` | ## Technical Details - Trigger shape: Send progressively larger `text/plain` SQL bodies to the Router SQL endpoint; the failing local sample used a 512 MiB body. - Root cause summary: The `SqlQuery.from` path reads the full input stream with `IOUtils.toByteArray(request.getInputStream())` and constructs a full string without a default body-size cap. - Exploitation conditions: Router is reachable anonymously; no account is required; no proxy or Druid setting rejects large bodies below the failure threshold. - Static source: `POST /druid/v2/sql/ with Content-Type text/plain or application/x-www-form-urlencoded; Router path also calls SqlQuery.from(HttpServletRequest,ObjectMapper).` - Static sink: `SqlQuery.from rawQueryExtractor uses IOUtils.toByteArray(request.getInputStream()) and constructs a String before trim/decode.` - Attacker-controlled driver: `HTTP request body byte volume; concurrent body submissions multiply live byte[]/String pressure.` ## Suggested Remediation - Add hard limits for request body size, object count, topic/job/key cardinality, queue length, active thread count, or aggregate retained bytes at the vulnerable entry. - Enforce authentication and quota checks before expensive body reads, decompression, JSON/protobuf parsing, image rendering, task creation, or state retention. - Add per-IP, per-user, per-token, or per-client rate and resource quotas for anonymous or low-privilege entries. - Return 400/413/429 as early as possible and avoid retaining complete request bodies, payloads, or incomplete protocol state after rejection. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
