xss vulnerability in upload_progress_poller

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.1.0 CE GA1, 6.1.10 EE GA1, 6.2.0 CE M2
• Fix Version/s: 6.0.X EE, 6.1.1 CE GA2, 6.1.20 EE GA2, --Sprint 11/12, 6.2.0 CE M2
• Component/s: Security
• Labels:
  • QA-R
• Environment:
  Hide

  Tomcat 6.0 + MySQL 5. Portal 6.0.x GIT ID: d2adf8c190bbe292476aaaa921f04eb17d21bafb. ; Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: 652d89f693d1542282073b84612b83c739c63692. ; Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: e8fe4e7b06ddf499c700aaebc5902363233c2b26.

  Show

  Tomcat 6.0 + MySQL 5. Portal 6.0.x GIT ID: d2adf8c190bbe292476aaaa921f04eb17d21bafb. Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: 652d89f693d1542282073b84612b83c739c63692. Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: e8fe4e7b06ddf499c700aaebc5902363233c2b26.
• Branch Version/s:
  6.1.x, 6.0.x
• Backported to Branch:
  Committed
• Fix Priority: 3
• Similar Issues: Show 4 results ; ;

  LPS-3152	XSS vulnerability in custom attributes
  LPS-3176	XSS vulnerability in password policies
  LPS-22586	XSS vulnerability in portlet title
  LPS-8831	XSS vulnerability in journal portlet

Login with the URL:

http://localhost:8080/html/portal/upload_progress_poller.jsp?uploadProgressId=a%3D1%3Balert(document.cookie)%3B%2F%2F

[Mark Jin]

Hi Jelmer,

Thank you for your report. I was able to reproduce this issue in our current trunk head. I will update this ticket to reflect this issue.

Thanks.

[Iliyan Peychev]

Sent PR to Nate for review:
https://github.com/natecavanaugh/liferay-portal/pull/640

[Mark Jin]

PASSED Manual Testing following the steps in the description.

Reproduced on:
Tomcat 7.0 + MySQL 5. Portal 6.1.10 EE GA1.

Able to see the pop up page.

Fixed on:
Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: a7fae664079fadbf1383e1090a858f5b908c4458.
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: ec3c3593540c45dc3d2e701eeff1eb2c2912dc58.

Unable to see the pop up page.

[Mark Jin]

PASSED Manual Testing following the steps in the description.

Fixed on:
Tomcat 6.0 + MySQL 5. Portal 6.0.x EE GIT ID: ec5c47db8fc85986edffc6349d1334477b6d6fbd.

[Edward Gonzales]

Slated for inclusion in 6.1.1 CE GA2

[Samuel Kong]

Committed on:
Portal 6.1.x CE GIT ID: bc71cd89572ad346d5b5c2a0042b1ef721bd1ee8.