CVE-2017-12630: Improper Neutralization of Input During Web Page Generation

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

Spoofable Clients

Apache Drill clients are vulnerable to being spoofed. When authenticating with a server, the configuration is not checked. This means if an attacker sets up a drillbit url with no authentication to spoof requests coming from a secured drillbit url, the connection will return as a success...

Cross-site Scripting (XSS)

Apache Drill is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input string in the query page or in the profile page, allowing a malicious user to inject and execute arbitrary Javascript...