CVE-2024-27438
📋 TL;DR
This vulnerability in Apache Doris allows authenticated users with JDBC catalog creation privileges to upload and execute arbitrary Java code via malicious JDBC driver files. Attackers can achieve remote command execution on the server. Affects Apache Doris versions 1.2.0 through 2.0.4.
💻 Affected Systems
- Apache Doris
📦 What is this software?
Doris by Apache
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Privilege escalation leading to database compromise, data exfiltration, and lateral movement within the network.
If Mitigated
Limited impact if proper access controls restrict JDBC catalog creation to trusted administrators only.
🎯 Exploit Status
Exploitation requires authenticated access with JDBC catalog creation permissions. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.5 or 2.1.x
Vendor Advisory: https://lists.apache.org/thread/h95h82b0svlnwcg6c2xq4b08j6gwgczh
Restart Required: Yes
Instructions:
1. Backup your Apache Doris configuration and data. 2. Download Apache Doris version 2.0.5 or 2.1.x from the official website. 3. Stop the Apache Doris service. 4. Replace the existing installation with the patched version. 5. Restart the Apache Doris service. 6. Verify the upgrade was successful.
🔧 Temporary Workarounds
Restrict JDBC Catalog Creation
allTemporarily remove JDBC catalog creation privileges from all non-essential users until patching can be completed.
-- Use Apache Doris SQL commands to revoke CREATE CATALOG privileges from users
-- Example: REVOKE CREATE CATALOG ON *.* FROM 'username'@'host';
🧯 If You Can't Patch
- Immediately restrict JDBC catalog creation to only essential, trusted administrators using role-based access controls.
- Implement network segmentation to isolate Apache Doris instances from sensitive systems and monitor for suspicious JDBC catalog creation attempts.
🔍 How to Verify
Check if Vulnerable:
Check the Apache Doris version using the web interface or by querying the system. If version is between 1.2.0 and 2.0.4 inclusive, the system is vulnerable.Check Version:
SELECT VERSION(); in Apache Doris SQL or check the web admin interface.Verify Fix Applied:
After upgrading, verify the version is 2.0.5 or higher (or in the 2.1.x series). Test JDBC catalog functionality with legitimate drivers to ensure it works correctly.📡 Detection & Monitoring
Log Indicators:
- Unusual JDBC catalog creation events, especially from non-admin users
- Errors or warnings related to JDBC driver loading or initialization
- Suspicious file uploads to JDBC driver directories
Network Indicators:
- Unexpected outbound connections from Apache Doris server to external IPs
- Unusual network traffic patterns following JDBC catalog operations
SIEM Query:
source="apache_doris" AND (event="catalog_creation" OR event="jdbc_driver_load") AND user!="admin_user"