Apache Zeppelin: Stored XSS in note permissions

Vulnerability

CVE-2022-46870 is a stored Cross-Site Scripting (XSS) vulnerability in Apache Zeppelin, a web-based notebook for interactive data analytics. The flaw arises from improper neutralization of user input during web page generation, enabling injection of arbitrary JavaScript code [1].

Exploitation

An attacker must be logged into the system and can submit malicious input through normal Zeppelin functionality. If a victim views the crafted content, the injected script executes in their browser session [1]. No special network position or additional privileges beyond a valid account are required.

Impact

Successful exploitation allows the attacker to perform actions on behalf of the victim user within the Zeppelin application, potentially accessing sensitive data, modifying notebooks, or escalating privileges. The XSS can also lead to session hijacking or further attacks on the organization's network [1].

Mitigation

The vulnerability affects Apache Zeppelin versions before 0.8.2. Users are strongly advised to upgrade to version 0.8.2 or later, which contains the fix [1]. No official workarounds have been published, and the product is actively maintained on GitHub [2].