Uploaded image for project: 'Service Packs and Hot Fixes'
  1. Service Packs and Hot Fixes
  2. MNT-12392

XSS - script embeddable in form/control-wrapper parameters

    Details

      Description

      The url share/service/components/form/control-wrapper can have it's parameters modified to include script which then executes in the user's browser.

      Steps to reproduce:

      • Setup a windows client with IE8 and Fiddler
        ( http://www.telerik.com/fiddler )
      • As admin, log into Share and go to Admin-> More -> Replication Jobs
      • Start Fiddler, Hit F11 (to break Before Requests are passed through)
      • In Share, click on "Create Job"
      • Inspect each call in Fiddler, until you get to the POST request to share/service/components/form/control-wrapper with htmlid=alf-id4
      • In Fiddler, change htmlid=alf-id4 to
        htmlid=alf-id4"/><script>alert(816)</script>

        It's best to do this in the "WebForms" section in Fiddler, so that everything is properly escaped.

      • In Fiddler, click on "Break On response" and check that the htmlid value is still shown in the returned function:
          (function()
                 {
                    new Alfresco.DatePicker("alf-id4&quot;/&gt;&lt;script&gt;alert(816)&lt;/script&gt;_schedule.start.iso8601-cntrl", "alf-id4&quot;/&gt;&lt;script&gt;alert(816)&lt;/script&gt;_schedule.start.iso8601").setOptions(
                    {
        
      • In Fiddler click on "Run to Completion"

      Expected Behaviour

      • No Pop-Up is shown

      Observed Behaviour

      • Alert pop is shown

        Attachments

          Structure

            Activity

              People

              • Assignee:
                closedbugs Closed Bugs (Inactive)
                Reporter:
                ahunt Andrew Hunt [X] (Inactive)
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 2 hours
                  2h

                    Structure Helper Panel