Summary
A high-severity authentication weakness in the StarTraining Druid Console may allow remote users to access functionality without the expected authentication checks. The issue affects the anonymous function in /druid/index.html and becomes risky when the console is remotely reachable without compensating access controls.
Affected context
The vulnerability occurs in StarTraining deployments up to version 3.8.1 where the Druid Console is exposed through /druid/index.html. Risk depends on whether the affected endpoint is reachable by an attacker and whether authentication is enforced by the application or by an external gateway, proxy, or network policy.
Exploit preconditions
- Attack surface: Remote access to the Druid Console web endpoint
- Required access: Network connectivity to the affected console; valid credentials may not be required
- Trigger point: Processing of requests handled by the anonymous function associated with
/druid/index.html - Why exploitation is possible: The affected path may permit access without correctly verifying the caller's identity or authentication state
Why this happens
The underlying issue is an incomplete or ineffective authentication check on a remotely accessible console path. This behavior maps primarily to CWE-287: Improper Authentication, because the application may fail to establish or verify the identity of a requester before granting access. It also relates to CWE-306: Missing Authentication for Critical Function, where a security-sensitive function is reachable without an authentication requirement.
Potential impact
- An unauthenticated user may gain access to Druid Console functionality
- Attackers could view or alter exposed data and configuration
- The vulnerable console could be used to expand access to connected services
- Unauthorized activity could undermine monitoring, data integrity, or administrative controls
General mitigation guidance
Mitigation generally focuses on ensuring that every sensitive console route has an explicit, consistently enforced authentication and authorization requirement.
Common defensive patterns include:
- Require authentication before serving console pages or processing console actions
- Apply deny-by-default authorization for administrative and data-management functions
- Place the console behind a trusted identity-aware gateway where appropriate
- Restrict network exposure through segmentation, firewall policy, and private access paths
- Use least-privilege identities and separate read-only functions from administrative operations
- Ensure unauthenticated requests cannot reach sensitive handlers through alternate routes
How teams detect issues like this
Organizations can assess this class of issue through:
- Static analysis and route audits that identify sensitive handlers marked anonymous or exempt from authentication
- Code review checks for missing middleware, authentication decorators, or authorization guards
- Dynamic testing that verifies protected console routes reject unauthenticated requests
- Web access-log analysis for successful console requests without an authenticated identity
- Policy enforcement requiring authentication coverage for administrative endpoints
- Automated security testing and code-review tools that flag missing authentication controls
