CVE-2024-45478: Apache Ranger Stored Cross-site Scripting Vulnerability in Edit Service Page
Summary
CVE-2024-45478: Apache Ranger has Stored Cross-site Scripting vulnerability in Edit Service Page. Affects org.apache.ranger:ranger versions < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is a framework that provides comprehensive security across the Hadoop ecosystem. It enables users to define, administer, and manage security policies consistently across various components. The Edit Service Page is a crucial part of the Ranger UI, allowing users to modify service configurations. However, a vulnerability has been identified that could allow attackers to exploit this interface.
Vulnerability Detail
The vulnerability is a Stored Cross-site Scripting (XSS) issue located in the Edit Service Page of the Apache Ranger UI. This flaw allows an attacker to inject malicious scripts into the application, which can then be executed in the context of another user's session. The implications of this vulnerability can lead to unauthorized actions being performed on behalf of users, data theft, or further exploitation of the application. The vulnerability is classified under CWE-20 and CWE-79, indicating improper input validation and cross-site scripting respectively.
How To Fix
Minimum fixed version
2.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on the Edit Service Page to mitigate the risk of XSS attacks until the upgrade can be performed. However, this is not a permanent solution and upgrading is strongly recommended.
Conclusion
The Stored Cross-site Scripting vulnerability in Apache Ranger's Edit Service Page poses a significant risk to users. It is crucial to upgrade to version 2.5.0 to mitigate this risk effectively. Users should also consider implementing temporary workarounds while preparing for the upgrade.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
It is a Stored Cross-site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application.
Apache Ranger version 2.4.0 is affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The vulnerability can lead to unauthorized actions, data theft, and further exploitation of the application by executing malicious scripts in the context of a user's session.
Yes, the CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
