{"id":6435,"date":"2017-01-30T14:20:35","date_gmt":"2017-01-30T22:20:35","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/30\/news-272\/"},"modified":"2017-01-30T14:20:35","modified_gmt":"2017-01-30T22:20:35","slug":"news-272","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/30\/news-272\/","title":{"rendered":"SSD Advisory \u2013 IBM WebSphere Portal Cross-Site Scripting (XSS)"},"content":{"rendered":"
\n

Vulnerabilities Summary<\/strong>
The following advisory describes a Cross-Site Scripting (XSS) vulnerability found in WebSphere Portal version 8.0.0.1.<\/p>\n

IBM WebSphere Portal products provide enterprise web portals that help companies deliver a highly-personalized, social experience for their customers. WebSphere Portal products give users a single point of access to the applications, services, information and social connections they need. These products help increase visitor response and reduce web operations cost while offering a range of capabilities to meet your business needs.<\/p>\n

Credit<\/strong>
An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

Vendor response<\/strong>
We notified IBM of the vulnerability back in September 2016, repeated attempts to re-establish contact and get some answer on the status of the patches for this vulnerability went unanswered. At this time there is no solution or workaround for this vulnerability.<\/p>\n

<\/span><\/p>\n

Vulnerabilities Details<\/strong>
IBM WebSphere Portal version 8.0.0.1 suffers from an input validation issue resulting in the bypass of the built-in anti Cross-Site Scripting (XSS) mechanism, which is implemented to filter potentially malicious HTML tags while updating user\u2019s profile detail. The identified vulnerability allows malicious users to perform stored XSS attacks in order to steal session cookie\u2019s token or perform CSRF attacks.<\/p>\n

Proof of Concept<\/strong>
The following HTTP request can be used to bypass the anti-XSS filter and store arbitrary JavaScript code as part of the user profile information:<\/p>\n<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n