Apache Doris is a high-performance, real-time analytical database based on the MPP architecture. Known for being efficient, simple, and unified, it returns query results over massive datasets within sub-second latency, and a single system supports both high-concurrency point queries and high-throughput complex analytics.
Apache Doris (Frontend) suffers from an arbitrary local file read through its JDBC catalog feature, and exposes an unsafe-deserialization option to the same attack surface. Connection properties for a JDBC catalog are passed to the MySQL driver without a safe allow-list (handleJdbcUrl() forces only benign params), so a user who can define or point a catalog at an attacker-controlled MySQL endpoint can enable dangerous driver options that the FE's JDBC client will honor. With allowLoadLocalInfile=true, a rogue MySQL server can answer any query with a LOCAL INFILE request and read arbitrary files from the FE host (fe/conf/fe.conf secrets, keytab, id_rsa).
Additionally, because autoDeserialize is not forced off, a malicious server can return a crafted blob that the driver deserializes. This can lead to remote code execution only if a suitable gadget is present on the Doris classpath.