| Summary: | XSS in page title | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [JBoss] JBoss Enterprise Portal Platform 5 | Reporter: | Marc Schoenefeld <mschoene> | ||||||||
| Component: | Portal | Assignee: | hfnukal <hfnukal> | ||||||||
| Status: | CLOSED NEXTRELEASE | QA Contact: | |||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 5.0.0.CR01, 5.1.1.DEV01, 5.1.1.CR01 | CC: | epp-bugs, hfnukal, mposolda, mvanco, smumford | ||||||||
| Target Milestone: | --- | ||||||||||
| Target Release: | 5.1.1.DEV02, 5.2.0.DEV02, 5.1.1.GA | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| URL: | http://jira.jboss.org/jira/browse/JBEPP-365 | ||||||||||
| Whiteboard: | EPP_RN_XSS | ||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2011-08-02 05:56:02 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Attachments: |
|
||||||||||
Attachment: Added: epp_page_title_xss.png Attachment: Added: epp_page_title_xss1_result.png I am reopening because issue still exists in EPP 5.1.1.CR1 Link: Added: This issue relates to JBQA-4899 Can you please check, where in html source of page is javascript? It is now encoded in <title> but it is probably displayed somewhere else. It's shown in pageManagement page after edit page.
Steps to reproduce with EPP 5.1.1.CR1:
* Login as root
* Go to http://localhost:8080/portal/private/classic/administration/pageManagement
* Click on some page: Edit page -> View page properties -> Change title of page to "joo<script>alert('hello')</script>"
* Click save -> Click finish -> Refresh page http://localhost:8080/portal/private/classic/administration/pageManagement and XSS appears.
Unfortunately there is another place where this XSS shows. Steps to reproduce: - Edit title of page portal::classic::homepage in page management as described in previous comment - Go to http://localhost:8080/portal/private/classic/portalnavigation - Click "Edit navigation" on classic portla - Click "Add node". Now you can see alert. Attachment: Added: JBEPP-365-PageManagement.patch Attached patch JBEPP-365-PageManagement.patch for fix XSS issues from both previous comments: https://issues.jboss.org/browse/JBEPP-365?focusedCommentId=12617532&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-12617532 https://issues.jboss.org/browse/JBEPP-365?focusedCommentId=12617563&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-12617563 It encodes groovy template UIRepeater.gtmpl, which is used for both PageManagement and for selecting page during edit navigation. So it covers both cases. I tested it successfully with EPP 5.1.1.CR1. Patch needs to be applied in project web/portal . Link: Added: This issue relates to JBEPP-997 Security: Removed: RHT+eXo Added: Public Release Notes Docs Status: Added: Not Required Release Notes Text: Added: Cross-site scripting was present in the portal::classic::homepage. The fix encodes groovy template UIRepeater.gtmpl, which is used for both PageManagement and for selecting page during edit navigation. Labels: Added: EPP_RN_XSS |
project_key: JBEPP XSS in page title </title><script>alert("xssed portal")</script>