Bug 988774 (CVE-2013-4181)

Summary: CVE-2013-4181 ovirt-engine: RedirectServlet cross-site scripting flaw
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: cpelland, juan.hernandez, kayhan, lpeer, mjc, pmatouse, security-response-team, srevivo, vkrizan, ykaul
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-20 10:40:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 988970, 988971, 1007482    
Bug Blocks: 988786, 999624    

Description Jan Lieskovsky 2013-07-26 10:38:40 UTC 
A cross-site scripting (XSS) flaw was found in the RedirectServlet of the oVirt Engine and Red Hat Enterprise Virtualization Manager (RHEV-M). A remote attacker could provide a specially-crafted link, that when visited by an unsuspecting RHEV-M / oVirt user would lead to arbitrary script execution in the context of the RHEV-M / oVirt domain.  Access to the RedirectServlet does not require authentication.
Comment 2 Tomas Hoger 2013-07-26 11:18:56 UTC 
This problem is in the addAlert method of the RedirectServlet:

http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=blob;f=backend/manager/modules/root/src/main/java/org/ovirt/engine/core/redirect/RedirectServlet.java;h=f6e79f0;hb=HEAD#l61

This method generates an HTML page with JavaScript alert used to display error message to the user.  Generated message includes content from the request.  This content is not properly sanitized - single quotes are replaced by double quotes to protect against certain attacks, however, </script> does not get filtered or escaped properly.
Comment 5 Jan Lieskovsky 2013-07-26 14:41:57 UTC 
Acknowledgements:

Red Hat would like to thank Kayhan KAYIHAN of Endersys A.Ş. for reporting this issue.
Comment 8 errata-xmlrpc 2013-09-10 19:05:16 UTC 
This issue has been addressed in following products:

  RHEV Manager version 3.2

Via RHSA-2013:1210 https://rhn.redhat.com/errata/RHSA-2013-1210.html