[AMBARI-25387] Ambari-Web UI hosts Tab is vulnerable to XSS attack

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: trunk, 2.6.2, 2.7.3
• Fix Version/s: 2.8.0, 2.7.5
• Labels: pull-request-available security
• Assignee: Akhil Naik
• Reporter: Akhil Naik
• Created: 01/Oct/19 10:32
• Updated: 14/Nov/22 16:37
• Resolved: 03/Oct/19 08:04

Description

Problem Statement : Ambari-Web UI hosts Tab is vulnerable to XSS attack

Issue reproduction :

1) Execute the Following CURL command to edit the Rack INFO .

curl -u admin:admin -H "X-Requested-By:ambari" -i -X PUT http://ambari-server:8080/api/v1/clusters/asnaik/hosts -d '{"RequestInfo":{"context":"Set Rack","query":"Hosts/host_name.in(abc.openstacklocal)"},"Body":{"Hosts":{"rack_info":"/default-rack/<IMG SRC='x' onerror=javascript:alert(domain);>"}}}'

where abc.openstacklocal is the host i want to change the rack info
(please note <IMG SRC='x' onerror=javascript:alert(domain);> we cannot add in UI via edit rack_info as in UI we checks for special characters)

Login to Ambari-UI -> navigate to Hosts and go to host : abc.openstacklocal

XSS will be injected to DOM and following Alert will be displayed.

Issue Links

• links to: GitHub PR#3491
• links to: GitHub Pull Request #3091