CVE-2021-26544: Cross-site scripting (XSS) in Apache Livy
Summary
CVE-2021-26544: Apache Livy Cross-site scripting (XSS) in session names. Affects org.apache.livy:livy-server versions >= 0.7.0-incubating, < 0.7.1-incubating. Fixed in 0.7.1-incubating. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Livy is a service that enables easy interaction with a Spark cluster over a REST interface. It allows users to submit Spark jobs, interact with the Spark shell, and manage sessions. The Livy server version 0.7.0-incubating is affected by a cross-site scripting (XSS) vulnerability in the session name. This vulnerability could be exploited by a malicious user to access logs and results of other users' sessions and run jobs with their privileges.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Apache Livy version 0.7.0-incubating allows an attacker to inject malicious scripts into the session name. This can lead to the execution of arbitrary code in the context of other users, potentially compromising their data and privileges. The vulnerability is rated as moderate with a CVSS score of 5.4. The issue has been fixed in Livy 0.7.1-incubating.
How To Fix
Minimum fixed version
0.7.1-incubating
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of Apache Livy.
Conclusion
The cross-site scripting (XSS) vulnerability in Apache Livy version 0.7.0-incubating can allow an attacker to execute arbitrary code in the context of other users, potentially compromising their data and privileges. It is crucial for users to upgrade to Apache Livy version 0.7.1-incubating or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.livy:livy-server →
FAQ
Apache Livy is a service that enables easy interaction with a Spark cluster over a REST interface. It allows users to submit Spark jobs, interact with the Spark shell, and manage sessions.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the victim's browser.
This vulnerability in Apache Livy allows an attacker to access logs and results of other users' sessions and run jobs with their privileges. It can lead to unauthorized access to sensitive data and potential compromise of the Spark cluster.
Yes, the vulnerability has been fixed in Apache Livy version 0.7.1-incubating. Users are advised to upgrade their Livy installations to the patched version.
The Livy project provides detailed instructions on how to upgrade the server. Users should follow the upgrade guide provided by the project to ensure a smooth transition to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.livy:livy-server.
