Uploaded image for project: 'Service Packs and Hot Fixes'
  1. Service Packs and Hot Fixes
  2. MNT-16163

5.1.1 Custom Type - Property is injected when using an HTML/XSS injection in Description

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Resolution: Fixed
    • Affects Version/s: 5.1.1
    • Fix Version/s: 5.1.1
    • Component/s: Content Modelling
    • Labels:
    • Environment:
      Alfresco Enterprise v5.1.1 (r125516-b55) schema 9029

      Description

      This will not affect version before 5.1.

      Preconditions:
      1. Go to Admin Tools -> Model Manager and create a new model
      2. For the new Model, create a Custom Type.
      3. For the new Custom Type, create a Property and set as _Description _ the following

      <img ='y><svg onload="alert(4)"'>

      4. For the new Custom Type, add in the Layout Designer, the created Property.
      5. Activate the model.

      Steps to reproduce:

      S1. Login to Share as admin and create a site.
      S2. Create any document and open document description.
      S3. Click on Change Type and choose the created Type.
      S4. After the type is applied, click on Edit Properties and observe the new Property.
      .
      Actual Result: The new Property is injected.

        Attachments

          Structure

            Activity

              People

              • Assignee:
                closedbugs Closed Bugs (Inactive)
                Reporter:
                czaharia Corina Zaharia [X] (Inactive)
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 5 hours
                  5h

                    Structure Helper Panel