From the forum post:
I have found a cross-site scripting vulnerability in the server2server jsp. This page handles the Server to Server settings. The parameter vulnerable to XSS is the domain parameter. To test you can simply add a script tag in to the domain field and use a valid port number. This will get persisted as well as cause a session to be taken/cause unwanted behavior such as an alert. (Example <script> alert('XSS Vulnerability'); </script>.
We can either provide the fix by using the already existing method removeXSSCharacters in StringUtils (I see in most case people use escapeHTMLTags) or use the industry wide standard of the ESAPI jar.
Suggested fix from community member
Server2Server.jsp -
Line 411 - <%= StringUtils.removeXSSCharacters(configuration.getDomain()) %>
Line 479 - <%= StringUtils.removeXSSCharacters(configuration.getDomain()) %>
My sense is that we should probably edit the domain value on input rather than output. I will take a closer look.
Applied input XSS filter for domain attribute on the S2S config page and performed some light testing via the admin console. Presumed fixed.