CVE-2017-12630 in Drill
Summary
by MITRE
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/15/2019
Apache Drill version 1.11.0 and earlier contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into query results which persist and execute in the Profile page context. This vulnerability stems from insufficient input validation and output encoding mechanisms within the web interface, specifically affecting the query submission and profile rendering components. The flaw enables attackers to craft malicious payloads that exploit the application's trust in user-provided data without proper sanitization. When a user submits a query containing malicious script content, the system stores this input without adequate filtering, allowing the script to execute in the context of other users who view the profile page. This creates a persistent cross-site scripting attack vector that can be leveraged to steal session cookies, perform unauthorized actions on behalf of victims, or exfiltrate sensitive information from the Drill environment. The vulnerability is categorized under CWE-79 as Cross-Site Scripting and aligns with ATT&CK technique T1566.001 for initial access through malicious content. The attack requires authentication to the Drill interface but does not require elevated privileges, making it particularly dangerous in environments where multiple users interact with the system. The persistence of the vulnerability occurs because the malicious script is stored in the system's query results and subsequently rendered in the profile page without proper HTML escaping or content security policy enforcement. This vulnerability represents a significant security risk to organizations using Apache Drill, as it can be exploited to compromise user sessions and potentially escalate to full system compromise if sensitive data is accessible through the Drill interface. The impact extends beyond simple information disclosure to include potential privilege escalation and data manipulation attacks. Organizations should implement immediate mitigations including input validation, output encoding, and content security policy enforcement to prevent script injection. Additionally, upgrading to Apache Drill version 1.12.0 or later resolves this vulnerability by implementing proper sanitization of user inputs and enhanced security controls in the web interface components. The vulnerability demonstrates the critical importance of proper input validation and output encoding in web applications, particularly in systems that process and display user-generated content. Security teams should conduct comprehensive assessments of their Drill deployments to identify and remediate similar issues in other components of the system. Regular security testing and code reviews should be implemented to prevent similar vulnerabilities from being introduced in future releases, as this type of flaw can have far-reaching consequences in enterprise environments where data access and processing capabilities are extensive.