CVE-2025-59390

# PoC概念验证：预测Kerberos Cookie签名密钥 import random import hashlib # ThreadLocalRandom的弱点在于其状态可被部分预测 # 攻击者收集足够的Cookie样本后可推断密钥 def generate_fallback_secret(): # 模拟Druid使用ThreadLocalRandom生成密钥的方式 random.seed() # 使用系统时间等熵源初始化 secret = ''.join([chr(random.randint(0, 255)) for _ in range(32)]) return hashlib.sha256(secret.encode()).hexdigest() print("预测的备用密钥:", generate_fallback_secret())

{"cve": {"id": "CVE-2025-59390", "sourceIdentifier": "[email protected]", "published": "2025-11-26T09:15:46.033", "lastModified": "2025-12-04T16:09:22.300", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`,\n which is not a crypto-graphically secure random number generator. This \nmay allow an attacker to predict or brute force the secret used to sign \nauthentication cookies, potentially enabling token forgery or \nauthentication bypass. Additionally, each process generates its own \nfallback secret, resulting in inconsistent secrets across nodes. This \ncauses authentication failures in distributed or multi-broker \ndeployments, effectively leading to a incorrectly configured clusters. Users are \nadvised to configure a strong `druid.auth.authenticator.kerberos.cookieSignatureSecret`\n\n\n\nThis issue affects Apache Druid: through 34.0.0.\n\nUsers are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the Kerberos authenticator. Services will fail to come up if the secret is not set."}, {"lang": "es", "value": "El autenticador Kerberos de Apache Druid utiliza un secreto de respaldo débil cuando la configuración `druid.auth.authenticator.kerberos.cookieSignatureSecret` no se establece explícitamente. En este caso, el secreto se genera utilizando `ThreadLocalRandom`, que no es un generador de números aleatorios criptográficamente seguro. Esto puede permitir a un atacante predecir o forzar por fuerza bruta el secreto utilizado para firmar las cookies de autenticación, lo que podría permitir la falsificación de tokens o eludir la autenticación. Además, cada proceso genera su propio secreto de respaldo, lo que da lugar a secretos inconsistentes entre los nodos. Esto provoca fallos de autenticación en implementaciones distribuidas o con múltiples brokers, lo que conduce efectivamente a clústeres configurados incorrectamente. Se recomienda a los usuarios que configuren un `druid.auth.authenticator.kerberos.cookieSignatureSecret` fuerte. Este problema afecta a Apache Druid: hasta la versión 34.0.0. Se recomienda a los usuarios que actualicen a la versión 35.0.0, que corrige el problema y hace obligatorio establecer `druid.auth.authenticator.kerberos.cookieSignatureSecret` cuando se utiliza el autenticador Kerberos. Los servicios no se iniciarán si no se establece el secreto."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-338"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*", "versionEndExcluding": "35.0.0", "matchCriteriaId": "7C05CCA2-CAD4-448C-B893-BDA365E75D0C"}]}]}], "references": [{"url": "https://lists.apache.org/thread/jwjltllnntgj1sb9wzsjmvwm9f8rlhg8", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/26/1", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}