Details
-
Type:
Improvement
-
Status: Closed
-
Priority:
Critical
-
Resolution: Fixed
-
Affects Version/s: 3.3, 4.0
-
Fix Version/s: EE-4.1.0.RC1, EE-4.1.0.GA, EE-3.3.0.GA_P04, 4.2.BETA, 4.2
-
Component/s: Framework
-
Labels:None
-
Environment:supported browsers
-
Assignee Priority:P1
-
Support Case References:
-
Affects:Documentation (User Guide, Ref. Guide, etc.)
Description
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only 'ice.view' parameter is vulnerable while in ICEfaces 4.* versions 'ice.view' and 'ice.window' parameters are vulnerable to JS injection attacks.
Activity
| Field | Original Value | New Value |
|---|---|---|
| Assignee | Mircea Toma [ mircea.toma ] |
| Fix Version/s | EE-4.1.0.GA [ 12171 ] |
| Fix Version/s | EE-3.3.0.GA_P04 [ 12270 ] |
| Status | Open [ 1 ] | Resolved [ 5 ] |
| Resolution | Fixed [ 1 ] |
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #48610 | Tue Apr 05 07:06:22 MDT 2016 | mircea.toma | |
| Files Changed | ||||
MODIFY
/icefaces4/trunk/icefaces/core/src/main/java/org/icefaces/impl/application/WindowScopeManager.java
MODIFY
/icefaces4/trunk/icefaces/core/src/main/java/org/icefaces/impl/event/BridgeSetup.java
|
| Summary | ice.window parameter vulnerable to JS injection | 'ice.window', 'ice.view' parameters vulnerable to JS injection attack |
| Security | Private [ 10001 ] | |
| Affects Version/s | 4.0 [ 11382 ] | |
| Affects Version/s | 3.3 [ 10370 ] | |
| Affects Version/s | 4.1.1 [ 12972 ] | |
| Priority | Major [ 3 ] | Critical [ 2 ] |
| Affects | Documentation (User Guide, Ref. Guide, etc.) [ 10003 ] | |
| Assignee Priority | P1 [ 10010 ] |
Re-opened to update description to be safe for public consumption and document specific original affected versions for each parameter.
| Resolution | Fixed [ 1 ] | |
| Status | Resolved [ 5 ] | Reopened [ 4 ] |
| Description | Loading a page with _ice.window_ parameter defined in the URL and with its value set to JS code that starts with ' character will have this code executed in the browser. |
Loading a page with _ice.window_ parameter defined in the URL and with its value set to JS code that starts with ' character will have this code executed in the browser.
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only _ice.view_ parameter is vulnerable while ICEfaces 4.* versions _ice.view_ and _ice.window_ are vulnerable to JS injection attacks. |
| Description |
Loading a page with _ice.window_ parameter defined in the URL and with its value set to JS code that starts with ' character will have this code executed in the browser.
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only _ice.view_ parameter is vulnerable while ICEfaces 4.* versions _ice.view_ and _ice.window_ are vulnerable to JS injection attacks. |
Loading a page with _ice.window_ parameter defined in the URL and with its value set to JS code that starts with ' character will have this code executed in the browser.
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only _ice.view_ parameter is vulnerable while in ICEfaces 4.* versions _ice.view_ and _ice.window_ parameters are vulnerable to JS injection attacks. |
| Status | Reopened [ 4 ] | Resolved [ 5 ] |
| Resolution | Fixed [ 1 ] |
| Description |
Loading a page with _ice.window_ parameter defined in the URL and with its value set to JS code that starts with ' character will have this code executed in the browser.
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only _ice.view_ parameter is vulnerable while in ICEfaces 4.* versions _ice.view_ and _ice.window_ parameters are vulnerable to JS injection attacks. |
Loading a page with _ice.window_ parameter defined in the URL and with its value set to JS code that starts with ' character will have this code executed in the browser.
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only 'ice.view' parameter is vulnerable while in ICEfaces 4.* versions 'ice.view' and 'ice.window' parameters are vulnerable to JS injection attacks. |
| Description |
Loading a page with _ice.window_ parameter defined in the URL and with its value set to JS code that starts with ' character will have this code executed in the browser.
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only 'ice.view' parameter is vulnerable while in ICEfaces 4.* versions 'ice.view' and 'ice.window' parameters are vulnerable to JS injection attacks. |
This behaviour makes ICEFaces vulnerable to Javascript injection attacks when accessed URLs contain Javascript code as parameter values. For ICEfaces 3.* versions only 'ice.view' parameter is vulnerable while in ICEfaces 4.* versions 'ice.view' and 'ice.window' parameters are vulnerable to JS injection attacks. |
| Security | Private [ 10001 ] |
The Jenkins EE-3.3 maintenance branch nightly build 706 that contained the commit for this fix may have caused a regression in the showcase ace:dataTable > Row State demo on the EE-3.3 maintenance branch.
While testing for ICE-10793 (dataTable) I came across an issue that was actually caused by the build before the commits for ICE-10793.
When using EE-3.3.0 maintenance branch Jenkins build 706, the EE.3.3 showcase > ace:dataTable > RowState demo the demo loads incorrectly and does not function when when using any of the Selection / Visibility / Editablilty or Editing button categories. The changes checked in for build 706 were for ICE-10998. There may be other demos affected, at this point I have not yet run regressions on the ee-3.3 maintenance branch.
This demo passes when using IF4 trunk.
Show
Liana Munroe
added a comment - - edited The Jenkins EE-3.3 maintenance branch nightly build 706 that contained the commit for this fix may have caused a regression in the showcase ace:dataTable > Row State demo on the EE-3.3 maintenance branch.
While testing for ICE-10793 (dataTable) I came across an issue that was actually caused by the build before the commits for ICE-10793 .
When using EE-3.3.0 maintenance branch Jenkins build 706, the EE.3.3 showcase > ace:dataTable > RowState demo the demo loads incorrectly and does not function when when using any of the Selection / Visibility / Editablilty or Editing button categories. The changes checked in for build 706 were for ICE-10998 . There may be other demos affected, at this point I have not yet run regressions on the ee-3.3 maintenance branch.
This demo passes when using IF4 trunk.
| Resolution | Fixed [ 1 ] | |
| Status | Resolved [ 5 ] | Reopened [ 4 ] |
Fix REGEX expression used to check the ice.view parameter. The generated view IDs have only digits or letters in them without the : (colon) character (like IF4 has).
Show
Mircea Toma
added a comment - Fix REGEX expression used to check the ice.view parameter. The generated view IDs have only digits or letters in them without the : (colon) character (like IF4 has).
| Status | Reopened [ 4 ] | Resolved [ 5 ] |
| Resolution | Fixed [ 1 ] |
Samples and tutorial tests have been run on ICEfaces-EE-3.3.0-maintenance r.48617, and ICEfaces4 trunk r.48623.
The changes committed for this JIRA cause the tabSet-caching tutorial to fail starting with Jenkins IF4 trunk Build# 1895, see ICE-11003.
Show
Carmen Cristurean
added a comment - Samples and tutorial tests have been run on ICEfaces-EE-3.3.0-maintenance r.48617, and ICEfaces4 trunk r.48623.
The changes committed for this JIRA cause the tabSet-caching tutorial to fail starting with Jenkins IF4 trunk Build# 1895, see ICE-11003.
ICE-11003 has now been fixed, at the app level. Please read the observations I make in my comment in that JIRA. This issue can occur in other applications, and we need to either document the workaround or prevent it with some more code.
Show
Arturo Zambrano
added a comment - ICE-11003 has now been fixed, at the app level. Please read the observations I make in my comment in that JIRA. This issue can occur in other applications, and we need to either document the workaround or prevent it with some more code.
| Fix Version/s | EE-4.1.0.BETA [ 13072 ] |
| Issue Type | Bug [ 1 ] | Improvement [ 4 ] |
| Fix Version/s | 4.2.BETA [ 13091 ] | |
| Fix Version/s | 4.2 [ 12870 ] |
| Status | Resolved [ 5 ] | Closed [ 6 ] |
Verify if the received window ID is valid before creating the associated scope map. Generate a new valid ID if needed.
Applied same strategy for ice.view parameter.