CVE_Apache Ranger: 3.0.0

[gozan10]

Exploit Title: XSS Stored Vulnerability in Apache Ranger Version: 3.0.0
Date: 20/02/2024
Exploit Author: Gozan
Contact: https://github.com/gozan10
Product: Apache Ranger (https://github.com/apache/ranger)
Vendor: Apache Ranger
Description: XSS Stored exitst in module Access Manager > Reports allow attacker excute arbitrary web script

First we need to create new group with payload in field name.
Payload:

<script>alert(1)</script>

Use burpsuite to change name groups (/service/xusers/secure/groups)

Then we go to Access Manager > Reports and click on Search By -> Group add a group containing malicious code

Then click Search

From then on, every time the group is clicked, the code is executed

Result