CVE-2024-24683 Apache Hop Engine: ID isn't escaped when generating HTML
An attacker can inject malicious scripts via unescaped ID parameters in Hop Server HTML output, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24683?
CVE-2024-24683 is a medium-severity cross-site scripting vulnerability in Apache Hop Engine, published on 19 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0.
Users are recommended to upgrade to version 2.8.0, which fixes the issue.
When Hop Server writes links to the PrepareExecutionPipelineServlet page one of the parameters provided to the user was not properly escaped. The variable not properly escaped is the "id", which is not directly accessible by users creating pipelines making the risk of exploiting this low.
This issue only affects users using the Hop Server component and does not directly affect the client.
Weakness: CWE-20
Which versions are affected by CVE-2024-24683?
2 open source packages ship an affected version, including org.apache.hop:hop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.hop:hop Maven | All versions | 2.8.0 |
org.apache.hop:hop Maven | All versions | 2.8.0 |
Products include Apache Hop Engine.
How do I fix CVE-2024-24683?
Upgrade org.apache.hop:hop to 2.8.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-24683 being exploited?
There is no known exploitation of CVE-2024-24683 in the wild and no public exploit code.
Sources
Also known as GHSA-f6g6-pjgc-5cj5.