CVE-2020-24922: xuxueli xxl-job Cross-Site Request Forgery Vulnerability
Summary
CVE-2020-24922: xuxueli xxl-job Cross-Site Request Forgery Vulnerability. Affects com.xuxueli:xxl-job versions < 2.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xxl-job is a Maven package that provides job scheduling and management capabilities. It is commonly used in Java applications to automate and manage tasks. The package allows users to define and schedule jobs, monitor their execution, and perform other related operations. However, version 2.2.0 of xxl-job is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can lead to arbitrary code execution and privilege escalation.
Vulnerability Detail
The vulnerability exists in the xxl-job-admin/user/add endpoint, which is susceptible to CSRF attacks. An attacker can craft a malicious HTML file that, when accessed by a victim with an active session on the vulnerable application, can execute arbitrary code and escalate privileges. This can result in unauthorized access, data theft, or even complete compromise of the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the vulnerable xxl-job-admin/user/add endpoint. This can be achieved by modifying the application's configuration or by implementing access control rules at the network level. However, applying the patch or upgrading to a non-vulnerable version is the recommended solution.
Conclusion
The xuxueli xxl-job package version 2.2.0 is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can result in arbitrary code execution and privilege escalation. It is crucial to upgrade to a non-vulnerable version of xxl-job and implement additional security measures to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.xuxueli:xxl-job →
FAQ
xxl-job is a Maven package that provides job scheduling and management capabilities for Java applications.
A CSRF attack is a type of security vulnerability where an attacker tricks a victim into performing unwanted actions on a web application in which the victim is authenticated.
This vulnerability can lead to unauthorized access, data theft, and privilege escalation on systems using the vulnerable version of xxl-job.
To mitigate the risk, it is recommended to upgrade to a non-vulnerable version of xxl-job and implement additional security measures, such as CSRF protection mechanisms.
For more information about this vulnerability, you can refer to the official GitHub advisory database or contact the maintainers of xxl-job.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.xuxueli:xxl-job.
