Apache Answer: XSS vulnerability when submitting summary

Vulnerability

CVE-2024-23349 is a stored cross-site scripting (XSS) flaw in Apache Answer, a Q&A platform. The vulnerability stems from improper neutralization of user input in the summary field during web page generation. Specifically, when a logged-in user modifies their own submitted question, the summary input is not sanitized, allowing the injection of arbitrary JavaScript or HTML code [1][2].

Exploitation

An authenticated attacker can exploit this vulnerability by editing a question they have submitted and inserting malicious code into the summary field. The attack does not require elevated privileges or a special network position—only a standard user account capable of posting and editing questions. The malicious payload is stored on the server and executed in the browser of any user who views the affected question [1][2].

Impact

Successful exploitation leads to arbitrary script execution in the context of the victim's browser session. This can result in data theft, session hijacking, defacement, or redirection to malicious sites. Since the XSS is stored, every visitor to the compromised question is affected, amplifying the potential damage [1][2].

Mitigation

The vulnerability affects Apache Answer versions through 1.2.1. Users should upgrade to version 1.2.5, which contains the fix. No official workaround has been provided. As of this writing, the CVE has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2][3].