CVE-2023-28158: Apache Archiva Privilege Escalation via Stored Cross-Site Scripting (XSS)
Summary
CVE-2023-28158: Apache Archiva vulnerable to privilege escalation via stored cross-site scripting (XSS). Affects org.apache.archiva:archiva versions >= 2.0.0, < 2.2.10. Fixed in 2.2.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Archiva is a Maven-based repository management tool used for storing and distributing build artifacts. It provides features such as artifact uploading, searching, and dependency management. The vulnerability identified as CVE-2023-28158 allows authenticated users to exploit a stored cross-site scripting (XSS) vulnerability by uploading malicious content through the file upload service. This vulnerability enables attackers to inject XSS content into directory names, potentially leading to privilege escalation and unauthorized access, including administrative privileges.
Vulnerability Detail
The vulnerability in Apache Archiva arises from a lack of input validation and sanitization when processing user-supplied directory names during file uploads. By crafting a malicious directory name containing XSS payloads, authenticated users can inject arbitrary JavaScript code into the application. When other users, including administrators, access the affected pages, the injected code executes within their browsers, leading to various consequences such as session hijacking, defacement, or data theft. The impact of this vulnerability is considered moderate, with a CVSS score of 6.5.
How To Fix
Minimum fixed version
2.2.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the file upload service in Apache Archiva until the upgrade to a patched version is feasible. This can be achieved by modifying the application's configuration to remove or restrict access to the file upload functionality. However, this workaround may limit the functionality of the repository management tool and should only be considered as a short-term solution.
Conclusion
The vulnerability in Apache Archiva allows authenticated users to exploit a stored cross-site scripting vulnerability, potentially leading to privilege escalation and unauthorized access. To mitigate this risk, it is recommended to upgrade to Apache Archiva version 2.2.10 or later. Alternatively, users can temporarily disable the file upload service until the upgrade is performed. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.archiva:archiva →
FAQ
This vulnerability affects users of Apache Archiva versions 2.0.0 to 2.2.9. Only authenticated users with the ability to upload files are capable of exploiting this vulnerability.
The impact of this vulnerability can vary depending on the privileges of the targeted user. If an administrator falls victim to the XSS attack, an attacker could gain full control over the Apache Archiva instance, potentially leading to unauthorized access, data manipulation, or further compromise of the underlying system.
At the time of this advisory, there are no known instances of this vulnerability being actively exploited in the wild. However, it is crucial to apply the recommended patches or workarounds promptly to mitigate the risk of exploitation.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate level of severity. It is important to address this vulnerability promptly to prevent potential privilege escalation attacks.
For more information about this vulnerability, including technical details and the fix, please refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-qf34-f43r-gv9p/GHSA-qf34-f43r-gv9p.json
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.archiva:archiva.
