CVE-2020-21485: Alluxio v1.8.1 reflected xss vulnerability · Issue #10552 · Alluxio/alluxio

A reflected XSS vulnerability was found in Allusio V1.8.1.

An attacker can inject arbitrary web script or HTML through the “path” parameter in the Browse board, causing a reflected XSS attack and stealing cookies.

POC:
msgbox(“foo”)";</script><script>alert(document.cookie)</script><script>

Vulnerability trigger point:
http://localhost/browse?path=%2F&offset=0&limit=9
XSS vulnerability will be successfully triggered when an attacker writes POC in the “path” parameter at the URL

Process:

1. Select browse and write POC in the “path” parameter

2.Trigger XSS vulnerability