CVE-2021-42357 DOM based XSS Vulnerability in Apache Knox
Attackers can execute malicious scripts or redirect users via crafted URLs in Apache Knox SSO, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-42357?
CVE-2021-42357 is a medium-severity cross-site scripting vulnerability in Apache Knox, published on 17 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.
Weakness: CWE-79
Which versions are affected by CVE-2021-42357?
2 open source packages ship an affected version, including org.apache.knox:gateway-service-knoxsso. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.knox:gateway-service-knoxsso Maven | All versions | 1.6.1 |
org.apache.knox:gateway-service-knoxsso Maven | All versions | 1.6.1 |
Products include Apache Knox.
How do I fix CVE-2021-42357?
Upgrade org.apache.knox:gateway-service-knoxsso to 1.6.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-42357 being exploited?
There is no known exploitation of CVE-2021-42357 in the wild and no public exploit code.
Other vulnerabilities in Apache Knox
Sources
Also known as GHSA-vv38-4xcj-q4rw.