Improved: Reflected XSS in content component
Fixes a Reflected XSS vulnerability in content component
Harshit Shukla reported it to the OFBiz security team:
https://demo-stable.ofbiz.apache.org/content/control/stream?contentId="><svg/onload=alert(0)>
It's a post-auth vulnerability so we did not ask for a CVE.
Thanks: Harshit Shukla
@@ -82,6 +82,13 @@ public class DataEvents {
// get the permission service required for streaming data; default is always the genericContentPermission
String permissionService = EntityUtilProperties.getPropertyValue("content", "stream.permission.service", "genericContentPermission", delegator);
+ // This is counterintuitive but it works, for OFBIZ-11840
+ // It could be improved by checking for possible events associated with svg
+ // As listed at https://portswigger.net/web-security/cross-site-scripting/cheat-sheet
+ if (contentId.contains("<svg")) {
+ return "success";
+ }
+
// get the content record
GenericValue content;
try {
