[DRILL-7351] WebUI is Vulnerable to CSRF

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.16.0
• Fix Version/s: 1.17.0
• Component/s: Web Server
• Labels: ready-to-commit
• Assignee: Anton Gozhiy
• Reporter: Don Perial
• Reviewer: Arina Ielchiieva
• Created: 16/Aug/19 04:16
• Updated: 29/Oct/19 14:33
• Resolved: 29/Oct/19 14:33

Description

There is no way to protect the WebUI from CSRF and the fact that the value for the access-control-allow-origin header is '*' appears to confound this issue as well.

The attached file demonstrates the vulnerability.

Steps to replicate:

1. Login to an instance of the Drill WebUI.
2. Edit the attached drill-csrf.html. Replace DRILL_HOST with the hostname of the Drill WebUI from step #1.
3. Load the file from #2 in the same browser as #1 either new tab or same window will do.
4. Return to the Drill WebUI and click on 'Profiles'.

Observed results:

The query 'SELECT 100' appears in the list of executed queries (see: Screen Shot 2019-08-19 at 10.11.50 AM.png ).

Expected results:

It should be possible to whitelist or completely restrict code from other domain names to submit queries to the WebUI.

Risks:

Potential for code execution by unauthorized parties.

 

 

Issue Links

• links to: GitHub Pull Request #1864