An undisclosed Cross-Site Scripting (XSS) vulnerability in Apache Velocity Tools can be exploited by unauthenticated attackers to target government sites, including NASA, BleepingComputer reported today.
Although 90 days have elapsed since the vulnerability was reported and patched, BleepingComputer is not aware of a formal disclosure made by the project.Security researcher Jackson Henry of the Sakura Samurai ethical hacking group had first discovered and reported the vulnerability to Apache in early October, 2020.
Although the project had acknowledged Henry’s report and issued a publicly visible fix on GitHub on November 5th, 2020, a proper public disclosure never took place which left Sakura Samurai researchers concerned.
Commenting on the news, Craig Young, principal security researcher at Tripwire, explained:
The vulnerability in question is a case of reflected cross-site scripting. With this type of weakness, the attacker prepares a malicious link and must convince victims to load this malicious address link in their browsers.
The impact of a reflected cross-site scripting generally varies based on whether the victim of an attack was authenticated to the affected site. If a logged-on user loads an attack URL, the attacker will be able to perform actions on the affected site using the victim’s account.
Besides using cross-site scripting for privilege escalation, an attacker might use this vulnerability to spoof content on vulnerable sites. For example, someone looking to spread conspiracy theories online could prepare links which make it look like official government web sites are confirming wild conspiracy theories. It’s also possible to imagine other, more targeted, attacks leveraging this style of spoofing attack.
The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY
Follow Us
© 2015 – 2019 IT Security Guru – Website Managed by Calm Logic
© 2015 – 2019 IT Security Guru – Website Managed by Calm Logic
This site uses functional cookies and external scripts to improve your experience.
Privacy Settings / PENDING
This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.
NOTE: These settings will only apply to the browser and device you are currently using.
GDPR Compliance

source