CVE_Apache Ranger: 3.0.0

[gozan10]

Exploit Title: XSS Stored Vulnerability in Apache Ranger Version: 3.0.0
Date: 15/02/2024
Exploit Author: Gozan
Contact: https://github.com/gozan10
Product: Apache Ranger (https://github.com/apache/ranger)
Vendor: Apache Ranger
Description: XSS Stored exitst in module Settings > Groups allow attacker excute arbitrary web script

First we need to create a new groups with payload in field name.
Payload:

<script>alert(1)</script>

Use burpsuite to change name groups (/service/xusers/secure/groups)

Then we go to Settings > Permissions and click on one of the created modules

Then add the user containing payload XSS in groups name and save

Lastly, in module Settings > Permissions excute payload XSS