Description

Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.  The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-04T08:17:16.473Z",
  "pubdate": "2026-09-04T08:17:16.473Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists within the SVN code repository component of Apache Allura.\nThis security flaw allows an authenticated attacker to inject malicious scripts into the repository, which are subsequently executed in the context of other users' sessions when they view the repository content.\nThe vulnerability affects Apache Allura versions up to and including 1.20.0.\nWhile Git repositories remain unaffected, the SVN implementation fails to properly sanitize inputs, potentially leading to unauthorized actions performed on behalf of legitimate users, session hijacking, or exfiltration of sensitive information.\nThe inherent risk is categorized as high, as it enables client-side code execution within the trust boundary of the Apache Allura application.\nAlthough default Content Security Policy (CSP) headers may provide a layer of mitigation, they do not remediate the underlying injection flaw.\nExploitation requires the attacker to have the capability to commit data to an SVN repository monitored or managed by the vulnerable Apache Allura instance.",
  "technicalDetails": "The vulnerability originates from improper neutralization of user-supplied data during the rendering process of SVN repository contents within the Apache Allura web interface.\nSpecifically, the component responsible for parsing and displaying SVN commit data or file contents fails to implement context-aware output encoding. This deficiency allows an attacker to inject arbitrary JavaScript payloads into SVN commit messages, filenames, or file contents.\nThe attack flow commences when an attacker commits a malicious payload to an SVN repository integrated with the Apache Allura platform. Because the application processes these commits and renders them to the web front-end without adequate sanitization, the payload is stored persistently within the application database or repository metadata.\nWhen a victimized user accesses the specific SVN repository page, the browser parses the repository information. The Apache Allura application inadvertently serves the injected script tag to the user's browser, which then executes the payload within the security origin of the Apache Allura domain.\nThis execution allows the attacker to bypass the Same-Origin Policy (SOP) to access sensitive data, such as session cookies, CSRF tokens, or proprietary repository data, and transmit them to an external, attacker-controlled server.\nThe stored nature of this XSS makes it particularly dangerous, as the malicious payload remains active until it is purged or the repository entry is modified. While the provided documentation suggests that default Content Security Policy (CSP) headers act as a partial mitigation, a robust CSP might block inline script execution; however, this is not a substitute for proper input sanitization and output encoding at the application level.\nThe affected versions are all releases up to 1.21.0. The vulnerability is localized to the SVN repository integration layer; Git repositories do not exhibit this specific parsing behavior and are thus excluded from this vulnerability scope. Successful exploitation typically requires the attacker to possess write access to the repository, although the impact affects any user with read access to the repository UI.\nPost-exploitation, an attacker can leverage the victim's session to perform unauthorized repository modifications, escalate privileges if the victim is an administrator, or pivot within the internal network context if the application is integrated with other internal systems."
}