[AMBARI-25384] Ambari Files View is Vulnerable to XSS attack

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: trunk, 2.6.2, 2.7.4
• Fix Version/s: 2.8.0, 2.7.5
• Component/s: ambari-views
• Labels: pull-request-available
• Assignee: Akhil Naik
• Reporter: Akhil Naik
• Created: 24/Sep/19 12:38
• Updated: 14/Nov/22 16:37
• Resolved: 03/Oct/19 07:22

Description

Problem Statement : Ambari Files view is vulnerable to XSS attack, if the Filename of the file uploaded in HDFS contains XSS scripts.

Reproduction :

1) login to files view

2) create a file called in your local system and upload it to files view: <svg onload= alert(document.domain)>

3) try to delete the file or edit permission of the file. the malciious XSS script will be executed in the Browser. this is a security Issue.

Please see attached screenshot

Issue Links

• links to: GitHub PR#3490
• links to: GitHub Pull Request #3088