CVE-2019-12397

Vulnerability

Description

The policy import functionality in Apache Ranger versions 0.7.0 through 1.2.0 is vulnerable to a Cross-Site Scripting (XSS) issue. This allows an attacker to inject malicious scripts into the policy import process. The vulnerability is present in the policy admin tool, which is used to import policies into Apache Ranger [1][3].

Exploitation

An attacker with access to the policy import functionality can craft a malicious policy containing XSS payload. When an administrator imports this policy via the web interface, the injected script executes in the context of the administrator's browser. The attacker does not require authentication to import policies; however, the victim must be an authenticated admin using the policy admin tool [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of an authenticated administrator. This can lead to session hijacking, manipulation of Ranger policies, or unauthorized actions performed on behalf of the victim. The vulnerability is stored, meaning the injected script persists and may affect all users who view the imported policy [1][3].

Mitigation

The vulnerability is fixed in Apache Ranger 2.0.0 and later versions. Users running versions 0.7.0 to 1.2.0 must upgrade to at least 2.0.0. The fix involves proper input validation during policy import [1][3]. As of the publication date, the vendor advisory confirms the fix is available in the 2.0.0 release [2][3].