Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application

Vulnerability

Overview

CVE-2022-34870 is a stored Cross-Site Scripting (XSS) vulnerability in the Pulse web application of Apache Geode versions up to 1.15.0. The flaw arises from insufficient sanitization of data stored in Region entries; when a Pulse user views such entries, injected malicious scripts are executed in the browser context [3].

Exploitation

Prerequisites

An attacker must first inject a crafted script into a Geode Region entry, which can be achieved through any Geode client that has write access to the Region. Subsequently, any Pulse user who views that entry will trigger the XSS payload. No additional authentication is required beyond normal Pulse access [3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript within the Pulse web application's security context. This can lead to session hijacking, defacement, or unauthorized actions performed on behalf of the victim, potentially compromising the entire Geode management interface [3].

Mitigation

Apache Geode has addressed this issue in versions after 1.15.0. Users are strongly advised to upgrade to a patched release. The vulnerability is tracked as GEODE-10411 [3].