We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Exploit Title: XSS Stored Vulnerability in Apache Ranger Version: 3.0.0 Date: 05/02/2024 Exploit Author: Gozan Contact: https://github.com/gozan10 Product: Apache Ranger (https://github.com/apache/ranger) Vendor: Apache Ranger Description: XSS Stored exitst in module Settings > Permissions allow attacker excute arbitrary web script
First we need to create a user account with payload in field name. Payload: "><img src=x onerror=alert('XSS');>
Then we go to Settings > Permissions and click on one of the created modules
Then add the user containing payload XSS and save
Lastly, in module Settings > Permissions excute payload XSS
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Exploit Title: XSS Stored Vulnerability in Apache Ranger Version: 3.0.0
Date: 05/02/2024
Exploit Author: Gozan
Contact: https://github.com/gozan10
Product: Apache Ranger (https://github.com/apache/ranger)
Vendor: Apache Ranger
Description: XSS Stored exitst in module Settings > Permissions allow attacker excute arbitrary web script
First we need to create a user account with payload in field name.
Payload:
"><img src=x onerror=alert('XSS');>
Then we go to Settings > Permissions and click on one of the created modules
Then add the user containing payload XSS and save
![image](https://private-user-images.githubusercontent.com/70020521/302218535-75d2b64c-3c1e-49b0-9228-39408ecd9114.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU2ODQzMTEsIm5iZiI6MTcyNTY4NDAxMSwicGF0aCI6Ii83MDAyMDUyMS8zMDIyMTg1MzUtNzVkMmI2NGMtM2MxZS00OWIwLTkyMjgtMzk0MDhlY2Q5MTE0LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA3VDA0NDAxMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTk3OWU3MGVjMWYxMzk5ODAzM2JjYjRiZTdkMzk3NGZmY2FjOWM0MjJlNzgxMzA2MjQxMDg5MTk3M2IwY2U2YmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0._-1NNiZmSHxY02b0NRwgm7aP-AD8L7DnUn5E8o5uql0)
![image](https://private-user-images.githubusercontent.com/70020521/302218601-a3655249-0ad6-4597-a867-f41bfd389f06.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU2ODQzMTEsIm5iZiI6MTcyNTY4NDAxMSwicGF0aCI6Ii83MDAyMDUyMS8zMDIyMTg2MDEtYTM2NTUyNDktMGFkNi00NTk3LWE4NjctZjQxYmZkMzg5ZjA2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA3VDA0NDAxMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWRmOGFmYmQ5MmQwYTFmODY2MTM1MmQ0MDMwZTM5ZDJhNDRhMTBhZWNjMjE3M2I5YjI0MDM1NDIzYWM0ODQ0NTYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.2ExHwcWC9BkXJvmOurDSm_7IQAf6j7McKAJNrxBHynQ)
Lastly, in module Settings > Permissions excute payload XSS
![image](https://private-user-images.githubusercontent.com/70020521/302222996-6b149988-5490-432a-a782-c92ef6b71493.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU2ODQzMTEsIm5iZiI6MTcyNTY4NDAxMSwicGF0aCI6Ii83MDAyMDUyMS8zMDIyMjI5OTYtNmIxNDk5ODgtNTQ5MC00MzJhLWE3ODItYzkyZWY2YjcxNDkzLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDclMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTA3VDA0NDAxMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTJmMWQ5ZGQ2ODdlZjJmNmU3ZjM4MDQyYjNlYzY5ZjAzZmEyN2VkYjJmYmJkNTdlYzc0ZjdiYTQ5YzAxZjM3YmMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.0-II4dgbT_3CNqcnUjMEbBBE2lGOOZ75D9nSCMajs0g)
The text was updated successfully, but these errors were encountered: