Cross Site Scripting

[Sharana Basavaraj Ballari, modifié il y a 8 années.]

Hey guys,

I ran into few issues when the website we built on Liferay has been penetration tested. There were two types of XSS issues we are facing at the moment.

1. Injecting malicious java-script in the URL and trying to execute it.
2. In control panel when I create a site by providing name with a bit of java-script code, it is getting executed which is a vulnerability.

My Question does Liferay have out of the box XSS protection if someone is trying to inject bad code from the URL ?

Liferay Portal 6.2.1 GA2 CE
MySql 5.5
Java 7u56

Many thanks,
/Sharan

[James Falkner, modifié il y a 8 années.]

Sharana Basavaraj Ballari:

Hey guys,

I ran into few issues when the website we built on Liferay has been penetration tested. There were two types of XSS issues we are facing at the moment.

1. Injecting malicious java-script in the URL and trying to execute it.
2. In control panel when I create a site by providing name with a bit of java-script code, it is getting executed which is a vulnerability.

My Question does Liferay have out of the box XSS protection if someone is trying to inject bad code from the URL ?

Liferay Portal 6.2.1 GA2 CE
MySql 5.5
Java 7u56

Many thanks,
/Sharan

This was fixed in 6.2 CE GA4 - See LPS-42754. You should upgrade to the latest CE GA4.

[Sharana Basavaraj Ballari, modifié il y a 8 années.]

James Falkner:

Sharana Basavaraj Ballari:

Hey guys,

I ran into few issues when the website we built on Liferay has been penetration tested. There were two types of XSS issues we are facing at the moment.

1. Injecting malicious java-script in the URL and trying to execute it.
2. In control panel when I create a site by providing name with a bit of java-script code, it is getting executed which is a vulnerability.

My Question does Liferay have out of the box XSS protection if someone is trying to inject bad code from the URL ?

Liferay Portal 6.2.1 GA2 CE
MySql 5.5
Java 7u56

Many thanks,
/Sharan

This was fixed in 6.2 CE GA4 - See LPS-42754. You should upgrade to the latest CE GA4.

Hey James,

Thank you. I understand that. For the URL injection of parameters, I am planning to implement a Filter Hook which implements Antisamy and clean the parameters and the process the request. Do you think this is the right way to do it? Or Liferay has already in place to handle this situation?

Please guide us.

Many thanks,
/Sharan

[Ranjith Narahari, modifié il y a 7 années.]

Hi Sharana,

I am facing the same XSS issues. Have you find any solution for that. Could you please share the how you fixed it.

Thanks & Regards,
Ranjith Narahari

[Olaf Kock, modifié il y a 7 années.]

James found a solution and posted it above: Just upgrade to the latest available version. Done. Relax & Party