XSS in server2server.jsp


From the forum post:

I have found a cross-site scripting vulnerability in the server2server jsp. This page handles the Server to Server settings. The parameter vulnerable to XSS is the domain parameter. To test you can simply add a script tag in to the domain field and use a valid port number. This will get persisted as well as cause a session to be taken/cause unwanted behavior such as an alert. (Example <script> alert('XSS Vulnerability'); </script>.

We can either provide the fix by using the already existing method removeXSSCharacters in StringUtils (I see in most case people use escapeHTMLTags) or use the industry wide standard of the ESAPI jar.




Tom Evans
May 10, 2013, 8:12 PM

Applied input XSS filter for domain attribute on the S2S config page and performed some light testing via the admin console. Presumed fixed.

Tom Evans
May 10, 2013, 7:42 PM

My sense is that we should probably edit the domain value on input rather than output. I will take a closer look.

Daryl Herzmann
May 8, 2013, 2:38 PM

Suggested fix from community member

Server2Server.jsp -

Line 411 - <%= StringUtils.removeXSSCharacters(configuration.getDomain()) %>
Line 479 - <%= StringUtils.removeXSSCharacters(configuration.getDomain()) %>

Your pinned fields
Click on the next to a field label to start pinning.


Tom Evans


Daryl Herzmann