[AMBARI-25283] Ambari UI evaluates Javascript embedded in user input when adding hosts, adding remote clusters, and renaming the cluster

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.3
• Fix Version/s: 2.8.0, 2.7.4
• Component/s: ambari-admin
• Labels: pull-request-available
• Assignee: Andriy Babiichuk
• Reporter: Andriy Babiichuk
• Created: 21/May/19 10:36
• Updated: 09/Nov/22 08:45
• Resolved: 21/May/19 12:59

Description

Ambari's UI evaluates Javascript blocks embedded in user input when adding hosts, adding remote clusters, and renaming the cluster.

The script evaluation appears to occur before the data is submitted and saved to the Ambari database (if save at all). Therefore, no XSS vulnerability needs to be reported since the scope of the threat is only to the interactive user at the instance the data is evaluated.

Add remote cluster steps to reproduce:

1. Log into ambari and navigate to admin > Manage Ambari> Cluster Management> Remote Cluster > Register Remote Cluster
2. Enter malicious script in Ambari Cluster URL textbox and click on save. The output of XSS is reflected.

Add hosts steps to reproduce:

1. Log into ambari and navigate to Hosts> Actions> Add New Hosts
2. Enter malicious script in Target Hosts textbox and click on save. The output of XSS is reflected

Edit cluster name steps to reproduce:

1. Log into ambari and navigate to admin > Manage Ambari> Cluster Management> Cluster Information
2. Enter malicious script in Cluster Name textbox. The output of XSS is reflected

Issue Links

• links to: GitHub PR#3466
• links to: GitHub Pull Request #2980