CVE-2023-48362
📋 TL;DR
This vulnerability allows attackers to perform XML External Entity (XXE) attacks through Apache Drill's XML Format Plugin. By uploading a malicious XML file, attackers can read arbitrary files from the remote file system or execute commands. This affects all Apache Drill users running version 1.19.0 or later.
💻 Affected Systems
- Apache Drill
📦 What is this software?
Drill by Apache
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to read sensitive files (including configuration files, credentials), execute arbitrary commands, and potentially pivot to other systems.
Likely Case
Data exfiltration of sensitive files from the Drill server, potentially including database credentials, configuration files, and other system information.
If Mitigated
Limited impact if proper network segmentation, file system permissions, and input validation are in place, though some information disclosure may still occur.
🎯 Exploit Status
XXE vulnerabilities are well-understood and relatively easy to exploit. The vulnerability requires the attacker to be able to upload or process XML files through Drill's XML Format Plugin.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.21.2
Vendor Advisory: https://lists.apache.org/thread/9tt0q4bdjwgw0dz0l9knqxjnpb5y6zsl
Restart Required: Yes
Instructions:
1. Download Apache Drill version 1.21.2 from the official Apache website. 2. Stop the running Drill service. 3. Backup your current installation and configuration. 4. Install version 1.21.2. 5. Restore your configuration if needed. 6. Start the Drill service.
🔧 Temporary Workarounds
Disable XML Format Plugin
allTemporarily disable the vulnerable XML Format Plugin to prevent exploitation
Edit drill-override.conf and add: drill.exec.formats.xml.enabled=false
Restart Apache Drill service
Restrict XML File Processing
allImplement input validation to reject or sanitize XML files before processing
Implement file upload validation in your application layer
Use XML parsers with XXE protection enabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Apache Drill instances from sensitive systems
- Apply strict file system permissions to limit what files the Drill process can access
🔍 How to Verify
Check if Vulnerable:
Check Apache Drill version: if version is >=1.19.0 and <1.21.2, the system is vulnerable.Check Version:
drill-conf --version or check the Drill web UI at http://localhost:8047Verify Fix Applied:
After patching, verify the version is 1.21.2 or later and test XML file processing functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual XML file processing activity
- File read operations from unexpected locations
- Error messages related to XML parsing failures
Network Indicators:
- Unusual outbound connections from Drill server
- Large data transfers following XML file uploads
SIEM Query:
source="apache_drill" AND (event_type="file_read" OR event_type="xml_parse") AND file_path CONTAINS "file://" OR "http://"