Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Security Vulnerability - Action Required: XSS vulnerability in the newest version of the datax-web #652

Open
Crispy-fried-chicken opened this issue Feb 1, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@Crispy-fried-chicken
Copy link

Describe the bug
I think your project allows Stored XSS (in Add User) to bypass the 20-character limit via datax-admin/src/main/java/com/wugui/datax/admin/controller/UserController.java#L27. It shares similarities to a recent CVE disclosure CVE-2020-29204 in thexuxueli/xxl-job.

The source vulnerability information is as follows:

Vulnerability Detail:
CVE Identifier: CVE-2020-29204
Description: XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
Reference:https://nvd.nist.gov/vuln/detail/CVE-2020-29204
Patch: xuxueli/xxl-job@2276285

To Reproduce
The reproduce step may be similiar to the xxl-job(xuxueli/xxl-job#2083)

Expected behavior
Add User

Which version of DataX Web:
the newest version

**Requirement or improvement
The corresponding fixes are similar to CVE-2020-29204 to some extent. You can follow the patch of CVE-2020-29204 to fix it.

@Crispy-fried-chicken Crispy-fried-chicken added the bug Something isn't working label Feb 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant