XSS issues in liferay portlets

[Vikas R Khengare, modifié il y a 14 années.]

Hi Friends,
We have found done security testing using IBM Rational AppScan 7.7 & found lots of XSS issues in liferay 4.3.0
eg
URL --> Parameter/Cookie
http://www.mydomain.com/c/portal/login
http://www.mydomain.com/c/portal/login --> emailAddress
http://www.mydomain.com/c/portal/login --> login
http://www.mydomain.com/user/admin/1 --> p_p_state
http://www.mydomain.com/user/admin/2 --> p_p_state
http://www.mydomain.com/web/guest/feedback --> p_p_mode
http://www.mydomain.com/web/guest/feedback --> p_p_state
http://www.mydomain.com/web/guest/help --> p_p_state

and lots of other.
most of the issues are on liferay login page and 'Mary Admin's private pages. Also their are issue in the portlets those are designed by us. In all the issues, most of them occurred because of p_p_mode & p_p_state parameters/cookies set by liferay.

Is there any way to get rid of this XSS? Can some one give me some guidelines to fix these issues?


Thank you.

regards,
Vikas Khengare

[zaheer mohammed saddapalli, modifié il y a 14 années.]

Hi,

This are the few open and known Issues.

http://issues.liferay.com/browse/LPS-3652
http://issues.liferay.com/browse/LEP-4270
http://issues.liferay.com/browse/LPS-3633
http://issues.liferay.com/browse/LEP-7056

Can you please reports all XSS issues in JIRAhttp://issues.liferay.com/

[Vikas R Khengare, modifié il y a 14 années.]

Hi Zaheer,

Thanks for your reply.

but is there any work around to these issues?

Thank you once again.

regards,
Vikas Khengare

[Joe Dirt, modifié il y a 14 années.]

Hi,

I got the same issue. Did you a solution for this?

I found this link http://www.securiteam.com/securitynews/5YP040KRPM.html which have this solution

Hope this will help you.

[Amos Fong, modifié il y a 14 années.]

In general, to fix these XSS issues, you can HtmlUtil.escape(variable) in the JSP before it is displayed.

For example,

<%
String param = ParamUtil.getString("test");
%>
<p>
This is a test parameter: &lt;%= HtmlUtil.escape(param) %&gt;
</p>

[Joe Dirt, modifié il y a 14 années.]

Hi,

In this case how do you escape p_p_state and p_p_mode in portlet:actionURL? If I put HtmlUtil.escape around it then the actionForm won't work.


Thanks for your help

[Olaf Kock, modifié il y a 14 années.]

You could change the code for the <portlet:actionURL> tag. In the current trunk it's located in portal/util-taglib/src/com/liferay/taglib/portlet/ActionURLTag.java - I hope it didn't change since 4.3. If you need to some other class, at least you can start exploring there.

Or you could update to a more recent (and actively supported) version. I've heard about a lot of XSS bugs that have been addressed since then but I haven't checked your specific ones.

[Joe Dirt, modifié il y a 14 années.]

Thanks Olaf.

We have been using LR 5.2.2 and these XSS still shows up. I found an issue with com.liferay.portal.servlet.taglib.portlet.RenderURLParamsTagUtil. Do you know where this Util get called? Thanks again for your help.

[Olaf Kock, modifié il y a 14 années.]

Joe Dirt:

I found an issue with com.liferay.portal.servlet.taglib.portlet.RenderURLParamsTagUtil. Do you know where this Util get called?

well, let's see... (Apologies if it's too verbose, but I've decided to post my steps instead of the solution...)
com.liferay.portal.servlet.taglib.portlet.RenderURLParamsTagUtil looks like something from a taglib... let's doublecheck:

olaf@kurt:~/liferay$ grep -R -1 RenderURLParamsTagUtil portal
portal/portal-impl/src/com/liferay/portal/servlet/taglib/portlet/RenderURLParamsTagUtil.java-/**
portal/portal-impl/src/com/liferay/portal/servlet/taglib/portlet/RenderURLParamsTagUtil.java: * <a href="RenderURLParamsTagUtil.java.html"><b><i>View Source</i></b></a>
portal/portal-impl/src/com/liferay/portal/servlet/taglib/portlet/RenderURLParamsTagUtil.java- *
--
portal/portal-impl/src/com/liferay/portal/servlet/taglib/portlet/RenderURLParamsTagUtil.java- */
portal/portal-impl/src/com/liferay/portal/servlet/taglib/portlet/RenderURLParamsTagUtil.java:public class RenderURLParamsTagUtil {
portal/portal-impl/src/com/liferay/portal/servlet/taglib/portlet/RenderURLParamsTagUtil.java-
--
portal/util-taglib/src/com/liferay/taglib/portlet/RenderURLParamsTag.java-      private static final String _TAG_CLASS =
portal/util-taglib/src/com/liferay/taglib/portlet/RenderURLParamsTag.java:              "com.liferay.portal.servlet.taglib.portlet.RenderURLParamsTagUtil";
portal/util-taglib/src/com/liferay/taglib/portlet/RenderURLParamsTag.java-

...and of course RenderURLParamsTag can be found in

portal/util-taglib/src/META-INF/liferay-portlet-ext.tld-                <name>renderURLParams</name>
portal/util-taglib/src/META-INF/liferay-portlet-ext.tld:                <tag-class>com.liferay.taglib.portlet.RenderURLParamsTag</tag-class>
portal/util-taglib/src/META-INF/liferay-portlet-ext.tld-                <body-content>JSP</body-content>

(other locations omitted)

So it's in the taglib liferay-portlet-ext.tld, which can be found here:

olaf@kurt:~/liferay$ grep -R -1 liferay-portlet-ext.tld portal plugins
portal/portal-web/docroot/WEB-INF/web.xml-                      <taglib-uri>http://liferay.com/tld/portlet</taglib-uri>                          
portal/portal-web/docroot/WEB-INF/web.xml:                      <taglib-location>/WEB-INF/tld/liferay-portlet-ext.tld</taglib-location>          
portal/portal-web/docroot/WEB-INF/web.xml-                                                                                              
...

and if we take a look at portal/util-taglib/src/com/liferay/taglib/portlet/RenderURLParamsTag.java, particularly the use of _TAG_CLASS, we'll see that there's some classloader and reflection magic to call doEndTag on the class in question... phew.

Now that this xss issue has been publicly discussed (I usually prefer to discuss this class of issues in private), you probably mean that key needs to be HTML-escaped too, right? Have I missed more?

For a fix, please refer to the (just created) LPS-5357

[Joe Dirt, modifié il y a 14 années.]

Thanks Olaf for your help to figure it out where the RenderURLParamsTagUtil go.

The RenderURLParamsTagUtil seems doesn't fix this issue. It does not escape the queryString. I have to build servlet filter to escape.

I hope this will help someone have similar issue.

[Olaf Kock, modifié il y a 14 années.]

Hi Joe,

just to be sure - there seems to be some contradiction:
"thanks" and "doesn't fix"... is that "thanks for the help, but it doesn't work" or is it "thanks, it works"
??

If another issue remains open, it should be added to the patch.

[Jason Roscoe, modifié il y a 13 années.]

Joe Dirt:

Thanks Olaf for your help to figure it out where the RenderURLParamsTagUtil go.

The RenderURLParamsTagUtil seems doesn't fix this issue. It does not escape the queryString. I have to build servlet filter to escape.

I hope this will help someone have similar issue.

Could you share your Servlet Filter code with the rest of us if yo have gotten this to work?

Thanks!