what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Liferay CE Stored Cross Site Scripting

Liferay CE Stored Cross Site Scripting
Posted Jun 1, 2016
Authored by Fernando Camara

Liferay CE versions prior to 6.2 CE GA6 suffer from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2016-3670
SHA-256 | 3e690a22ff5bca0489c813c1cf6feee3cda703e240550e0b23a3d268f6238f9c

Liferay CE Stored Cross Site Scripting

Change Mirror Download
Fernando Câmara @ Integrity S.A
www.integrity.pt
https://twitter.com/overflowy

https://labs.integrity.pt/advisories/cve-2016-3670/

---


CVE-2016-3670 Stored Cross Site Scripting in Liferay CE

1. Vulnerability Properties

Title: Stored Cross-Site Scripting Liferay CE
CVE ID: CVE-2016-3670
CVSSv3 Base Score: 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Vendor: Liferay Inc
Products: Liferay
Advisory Release Date: 27 May 2016
Advisory URL: https://labs.integrity.pt/advisories/cve-2016-3670
Credits: Discovery by Fernando Câmara <fbc[at]integrity.pt>

2. Vulnerability Summary

Liferay is vulnerable to a stored XSS when an user is created with an
malicious payload on the FirstName field.
The javascript payload is executed when another user tries to use the
profile search section.
3. Technical Details

An XSS vulnerability was found on the Profile Search functionality,
accessible through User -> My Profile -> Search. An attacker can set a
malicious javascript payload on his First Name affecting anyone who
performs a search using a keyword present on his profile.

The exploitation of this vulnerability could lead to an effective way to
grab cookies (stealing sessions) from anyone that uses that search
component.

Exploitation Request: (User Registration with an malicious FirstName field)

POST /liferay/web/guest/home?p_p_id=58&p_p_lifecycle=1&p_p_state=
maximized&p_p_mode=view&_58_struts_action=%2Flogin%2Fcreate_account

Data:

_58_firstName=%22%3E%3Cscript%3Ealert%28%27xss%27%29%3C%2

The vulnerability is located on the users.jsp and as shown below the origin
is the lack of validation of user input:

line 64: <a data-value=”<%= curUserName %>” href=”javascript:;”>

4. Vulnerable Versions

< 6.2 CE GA6

5. Solution

Update to version 7.0.0 CE RC1

6. Vulnerability Timeline

21/Jan/16 - Bug reported to Liferay
22/Mar/16 – Bug verified by vendor
22/Mar/16 – Bug fixed by vendor
27/May/16 – Advisory released


7. References

https://issues.liferay.com/browse/LPS-62387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3670


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close