IFrame portlet vulnerable to password theft

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Completed
• Affects Version/s: 5.1 EE SP4 (5.1.7), 5.2 EE SP1 (5.2.5)
• Fix Version/s: 5.1 EE SP5 (5.1.8), 5.2 EE SP2 (5.2.6)
• Component/s: Application Security, WCM > IFrame portlet
• Labels:
  • 5.2_release_notes
• Environment: All

The IFrame portlet is vulnerable to password theft if untrusted users are allowed to add an IFrame portlet to a page. The untrusted user can configured the portlet to use the token @[email protected] (which contains a user's portal password) to send a user's password to a page that is setup to record the passwords.

To address this issue, a new property has been added to portal(-ext).properties

#

1. Specify a role name that a user must be associated with in order to
2. configure the IFrame portlet to use the @[email protected] token. This token is
3. used to post the password of users who access this portlet in order to
4. automatically login to the framed site.
   #
5. No role is required by default. However, it is recommended that you
6. specify a role in high security environments where users who configure
7. this portlet may attempt password theft.
   #
   iframe.password.token.role