[DRILL-5766] Stored XSS in APACHE DRILL

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.10.0, 1.11.0
• Fix Version/s: 1.12.0
• Component/s: Functions - Drill
• Labels: cross-site-scripting ready-to-commit security security-issue xss

Environment

Apache drill installed in debian system

• Assignee: Arina Ielchiieva
• Reporter: Sanjog Panda
• Reviewer: Parth Chandra
• Created: 04/Sep/17 07:24
• Updated: 29/Dec/17 12:22
• Resolved: 12/Sep/17 10:49

Description

Hello Apache security team,

I have been testing an application which internally uses the Apache drill software v 1.6 as of now.

I found XSS on profile page (sink) where in the user's malicious input comes from the Query page (source) where you run a query.

Affected URL : https://localhost:8047/profiles

Once the user give the below payload and load the profile page, it gets triggered and is stored.

I have attached the screenshot of payload <script>alert(document.cookie)</script>.

*[screenshot link]
*
https://drive.google.com/file/d/0B8giJ3591fvUbm5JZWtjUTg3WmEwYmJQeWd6dURuV0gzOVd3/view?usp=sharing
https://drive.google.com/file/d/0B8giJ3591fvUV2lJRzZWOWRGNzN5S0JzdVlXSG1iNnVwRlAw/view?usp=sharing

Issue Links

• links to: GitHub Pull Request #935
• links to: GitHub Pull Request #955