支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 211748bd0e392a7a8c360e805d07bb8c256e8b9c

来源
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-27888.yaml
关联漏洞
标题:Apache Druid 代码问题漏洞 (CVE-2025-27888)
Description:Apache Druid是美国阿帕奇（Apache）基金会的一款使用Java语言编写的、面向列的开源分布式数据库。 Apache Druid存在代码问题漏洞，该漏洞源于服务器端请求伪造、跨站脚本和开放重定向，可能导致XSS或XSRF攻击。
Description
Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.This issue affects all previous Druid versions.When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.
文件快照

 id: CVE-2025-27888

info:
  name: Apache Druid - Server-Side Request Forgery
  author: xbow,Dhiyanes

...
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。