64 lines
No EOL
1.9 KiB
Text
64 lines
No EOL
1.9 KiB
Text
CVE-2016-3670 Stored Cross Site Scripting in Liferay CE
|
||
|
||
1. Vulnerability Properties
|
||
|
||
Title: Stored Cross-Site Scripting Liferay CE
|
||
CVE ID: CVE-2016-3670
|
||
CVSSv3 Base Score: 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
|
||
Vendor: Liferay Inc
|
||
Products: Liferay
|
||
Advisory Release Date: 27 May 2016
|
||
Advisory URL: https://labs.integrity.pt/advisories/cve-2016-3670
|
||
Credits: Discovery by Fernando Câmara <fbc[at]integrity.pt>
|
||
|
||
2. Vulnerability Summary
|
||
|
||
Liferay is vulnerable to a stored XSS when an user is created with an
|
||
malicious payload on the FirstName field.
|
||
The javascript payload is executed when another user tries to use the
|
||
profile search section.
|
||
3. Technical Details
|
||
|
||
An XSS vulnerability was found on the Profile Search functionality,
|
||
accessible through User -> My Profile -> Search. An attacker can set a
|
||
malicious javascript payload on his First Name affecting anyone who
|
||
performs a search using a keyword present on his profile.
|
||
|
||
The exploitation of this vulnerability could lead to an effective way to
|
||
grab cookies (stealing sessions) from anyone that uses that search
|
||
component.
|
||
|
||
Exploitation Request: (User Registration with an malicious FirstName field)
|
||
|
||
POST /liferay/web/guest/home?p_p_id=58&p_p_lifecycle=1&p_p_state=
|
||
maximized&p_p_mode=view&_58_struts_action=%2Flogin%2Fcreate_account
|
||
|
||
Data:
|
||
|
||
_58_firstName=%22%3E%3Cscript%3Ealert%28%27xss%27%29%3C%2
|
||
|
||
The vulnerability is located on the users.jsp and as shown below the origin
|
||
is the lack of validation of user input:
|
||
|
||
line 64: <a data-value=”<%= curUserName %>” href=”javascript:;”>
|
||
|
||
4. Vulnerable Versions
|
||
|
||
< 6.2 CE GA6
|
||
|
||
5. Solution
|
||
|
||
Update to version 7.0.0 CE RC1
|
||
|
||
6. Vulnerability Timeline
|
||
|
||
21/Jan/16 - Bug reported to Liferay
|
||
22/Mar/16 – Bug verified by vendor
|
||
22/Mar/16 – Bug fixed by vendor
|
||
27/May/16 – Advisory released
|
||
|
||
|
||
7. References
|
||
|
||
https://issues.liferay.com/browse/LPS-62387
|
||
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3670 |