[AMBARI-24509] Security vulnerabilities with Hive view (XSS)

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6.0
• Fix Version/s: 2.6.2
• Component/s: ambari-views
• Labels: pull-request-available
• Assignee: Nitiraj Singh Rathore
• Reporter: Nitiraj Singh Rathore
• Due: 23/Aug/18
• Created: 21/Aug/18 04:49
• Updated: 23/Aug/18 11:28
• Resolved: 23/Aug/18 10:26

Description

It is possible for an attacker to steal information or access from users by executing malicious javascript. This is possible due to hive directly taking data/information from events and directly populating messages, this includes directly inserting data that contains html or javascript code. Leveraging this one user could create a malicious message to steal access or information of another user. Upon viewing the malicious message the vicitim would be comprimised by directly scraping any information on the page, modify its appearence, or having their session information stolen.

Bug reproduce steps:
1. go to Hive view from Ambari
2. click on 'Tables' and click on '+' to create a new table
3. In the table name input: '"<img src=x onerror=alert(document.domain)>"' and add a column with name <img src=x onerror=alert(document.domain)> and datatype TINYINT and click on create
4. There is a javascript popup showing the document name and domain name

Issue Links

• links to: GitHub Pull Request #2123