6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-41177

CVE-2024-41177: Apache Zeppelin: XSS in the Helium module

Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.

This issue affects Apache Zeppelin: before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-41177

CVE-2024-41177:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.zeppelin:zeppelin-web	maven	< 0.12.0	0.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Helium module of Apache Zeppelin, where user-controllable information from Helium packages was being rendered as HTML without proper sanitization, leading to a cross-site scripting (XSS) vulnerability. The analysis of the provided patches confirms this.

The first patch, from commit 04ce288adb96458bb4eb978ddeb700e1d42a5a26, removes the use of $sce.trustAsHtml in the getDescriptionText function within HeliumCtrl. The use of $sce.trustAsHtml is a clear indicator of an intentional but unsafe rendering of HTML from a variable, in this case, the package description. This is a classic XSS vulnerability.

The second patch, from commit ddfaf9bde168c11e73a0a090bd440814acd4c2ff, adds escaping to the description and license fields within a modal dialog in the same HeliumCtrl controller. This indicates that these fields were also being rendered unescaped, creating another vector for XSS. The patch applies _.escape() to mitigate this.

Therefore, any user interaction that involves viewing the details of a Helium package, either in the main view or in a modal dialog, could trigger the vulnerability if the package contains a malicious description or license. The identified functions are directly responsible for this unsafe rendering and would be present in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.