[IMPALA-1133] Ensure all webserver output is escaped

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Impala 1.3.1
• Fix Version/s: Impala 2.0
• Environment: 1 name node 3 datanodes
• Assignee: Henry Robinson
• Reporter: charles
• Created: 05/Aug/14 15:25
• Updated: 20/Dec/15 00:05
• Resolved: 18/Aug/14 23:34

Description

I just recieved this issue from our Nessus application

Synopsis :

The remote web server is prone to a cookie injection attack.

Description :

The remote host is running a web server that fails to adequately
sanitize request strings of malicious JavaScript. By leveraging this
issue, an attacker may be able to inject arbitrary cookies. Depending
on the structure of the web application, it may be possible to launch
a 'session fixation' attack using this mechanism.