Description
Apache Druid存在服务器请求伪造漏洞，攻击者可以直接访问的内部系统。
Apache Druid存在服务器请求伪造漏洞(CVE-2025-27888)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-27888
https://lists.apache.org/thread/c0qo989pwtrqkjv6xfr0c30dnjq8vf39
https://xbow.com/blog/apache-druid-proxy
https://github.com/advisories/GHSA-2xcr-p767-f3rv
https://www.miggo.io/vulnerability-database/cve/CVE-2025-27888
https://avd.aliyun.com/detail?id=AVD-2025-27888
https://www.nsfocus.net/vulndb/118138
https://rewterz.com/threat-advisory/cve-2025-27888-apache-druid-vulnerability
https://varutra.com/ctp/threatpost/postDetails/Apache-Druid-Vulnerability-(CVE-2025-27888)-Exposes-Real-Time-Analytics-Systems-to-SSRF-and-XSS-Threats/M1YvZ2tmYjRFRTc3a3VwWWw2M2dMZz09
https://cn-sec.com/archives/3862465.html