CVE-2023-48362: High XXE Flaw in Apache Drill XML Format Plugin

CVE-2023-48362 is a high severity (CVSS 8.8) XML external entity flaw in the XML format plugin of Apache Drill, from 1.19.0 up to but not including 1.21.2. A malicious XML file can read files or run commands. Upgrade to 1.21.2 or later. The Apache announcement rates it moderate.

What's affected

The Apache Drill announcement on the user mailing list, repeated on oss-security on 24 July 2024, gives the affected range as Apache Drill 1.19.0 before 1.21.2, and recommends upgrading to 1.21.2. It says the XML format plugin allows a user to read any file on a remote file system or execute commands via a malicious XML file. It tracks the issue as DRILL-8461 and credits Yuzhe Huang as the finder.

There is a severity difference. The Apache announcement says moderate. The NVD record scores it 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which needs a low privilege account that can query data. If your Drill cluster accepts queries from many users, plan on the higher score.

The weakness is CWE-611 (Improper Restriction of XML External Entity Reference). The record does not flag the CVE as exploited in the wild.

How to check if you're exposed

Ask Drill itself, from the shell or the web console.

SELECT version FROM sys.version;

You can also read the directory name of the installation, which normally contains the version, for example apache-drill followed by the version number. Anything from 1.19.0 up to 1.21.1 is affected. Releases before 1.19.0 are outside the range named in the announcement.

Check where the XML format plugin is enabled in the storage plugin configuration, and who is allowed to query those storage locations. Include every cluster, including development and analytics ones that few people remember.

What to do now

1. Upgrade Apache Drill to 1.21.2 or later on every node.
2. Restrict who can run queries, and limit which file systems and paths the storage plugins can reach.
3. Run Drill under a service account with minimal file system rights, so that a file read or command is contained.
4. Disable the XML format plugin if you do not use it.
5. Treat XML files from outside your organisation as untrusted input.

Why it matters

XML allows a document to declare external entities, which tell the parser to fetch a file or URL and insert it. If the parser lets documents declare them, a crafted file can pull in local files or trigger other actions. The standard fix is to turn that feature off in the parser configuration. The class is CWE-611 (Improper Restriction of XML External Entity Reference).

For data platforms the risk is that users can point the engine at files they did not write. Query engines run with broad file access, so a parser flaw can reach far. Reachability analysis helps you tell whether the vulnerable plugin is on a path your deployment actually uses. See the Safeguard Gold page for this CVE for the record.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Apache Drill announcement on the user mailing list
• oss-security post, 24 July 2024
• NVD record for CVE-2023-48362

Last reviewed: 19 October 2026.