CVE-2018-1328

Vulnerability

CVE-2018-1328 is a stored cross-site scripting (XSS) vulnerability in Apache Zeppelin, affecting versions prior to 0.8.0. The issue exists in the Note permissions functionality, where user-supplied input is not properly sanitized before being stored and later rendered in the browser. This allows an attacker to inject malicious scripts that persist within the application [1][2].

Exploitation

To exploit this vulnerability, an attacker must have the ability to create or modify Note permissions within Zeppelin. No special network position is required beyond normal user access; the attack is carried out by crafting a malicious payload in the permission fields. When other users view the affected Note, the injected script executes in their browser context, bypassing same-origin policies [2].

Impact

Successful exploitation enables an attacker to perform actions on behalf of the victim, such as stealing session cookies, exfiltrating sensitive data displayed in the notebook, or performing administrative actions if the victim has elevated privileges. The stored nature of the XSS means the attack can affect multiple users over time without repeated interaction [1][2].

Mitigation

The vulnerability is fixed in Apache Zeppelin version 0.8.0, released in July 2018. Users are strongly advised to upgrade to this version or later. No workarounds are documented; upgrading is the recommended remediation [2][3].