Alluxio v1.8.1 reflected xss vulnerability

[upclose]

A reflected XSS vulnerability was found in Allusio V1.8.1.

An attacker can inject arbitrary web script or HTML through the "path" parameter in the Browse board, causing a reflected XSS attack and stealing cookies.

POC:
msgbox("foo")";</script><script>alert(document.cookie)</script><script>

Vulnerability trigger point:
http://localhost/browse?path=%2F&offset=0&limit=9
XSS vulnerability will be successfully triggered when an attacker writes POC in the "path" parameter at the URL

Process:

1. Select browse and write POC in the "path" parameter
   

2.Trigger XSS vulnerability

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in two weeks if no further activity occurs. Thank you for your contributions.

[jja725]

Will close it for now, feel free to reopen it and contact us if this is a strong request.