[ https://issues.apache.org/jira/browse/AMBARI-25283?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Zhiguo Wu updated AMBARI-25283: ------------------------------- Fix Version/s: 2.8.0 > Ambari UI evaluates Javascript embedded in user input when adding hosts, > adding remote clusters, and renaming the cluster > ------------------------------------------------------------------------------------------------------------------------- > > Key: AMBARI-25283 > URL: https://issues.apache.org/jira/browse/AMBARI-25283 > Project: Ambari > Issue Type: Bug > Components: ambari-admin > Affects Versions: 2.7.3 > Reporter: Andriy Babiichuk > Assignee: Andriy Babiichuk > Priority: Major > Labels: pull-request-available > Fix For: 2.8.0, 2.7.4 > > Time Spent: 1h 10m > Remaining Estimate: 0h > > Ambari's UI evaluates Javascript blocks embedded in user input when adding > hosts, adding remote clusters, and renaming the cluster. > The script evaluation appears to occur before the data is submitted and saved > to the Ambari database (if save at all). Therefore, no XSS vulnerability > needs to be reported since the scope of the threat is only to the interactive > user at the instance the data is evaluated. > *Add remote cluster steps to reproduce:* > # Log into ambari and navigate to admin > Manage Ambari> Cluster Management> > Remote Cluster > Register Remote Cluster > # Enter malicious script in Ambari Cluster URL textbox and click on save. The > output of XSS is reflected. > *Add hosts steps to reproduce:* > # Log into ambari and navigate to Hosts> Actions> Add New Hosts > # Enter malicious script in Target Hosts textbox and click on save. The > output of XSS is reflected > *Edit cluster name steps to reproduce:* > # Log into ambari and navigate to admin > Manage Ambari> Cluster Management> > Cluster Information > # Enter malicious script in Cluster Name textbox. The output of XSS is > reflected -- This message was sent by Atlassian Jira (v8.20.10#820010) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@ambari.apache.org For additional commands, e-mail: issues-h...@ambari.apache.org