Uploaded image for project: 'Oozie'
  1. Oozie
  2. OOZIE-3202

Oozie web console 'Custom Filter' can be attacked by XSS vulnerability

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Open
    • Major
    • Resolution: Unresolved
    • 4.1.0, 4.0.1, 4.2.0, 4.3.0, 4.3.1
    • None
    • workflow
    • None

    • No sepcial environment is needed.

    Description

      Step1. Open oozie web console

      Step2. Click 'Custom Filter' and 'Custom Filter'(menu)

       

      Step3. Input something like '<img src=11 onerror=alert(1)>' into 'Filter text', then click 'OK'

      Then we get some problem:

       

       

      Attachments

        1. image-2018-03-28-18-32-33-384.png
          2 kB
          YijieShen
        2. image-2018-03-28-18-32-53-630.png
          3 kB
          YijieShen
        3. image-2018-03-28-18-34-17-974.png
          2 kB
          YijieShen
        4. image-2018-03-28-18-34-34-268.png
          0.9 kB
          YijieShen

        Activity

          People

            Unassigned Unassigned
            ShineSky YijieShen
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: