Cross Site Scripting | v10.5.4 | New User

[varchashva]

Hello Team,

I would like to report a vulnerability (cross-site-scripting) which I have observed in current version v10.5.4 and before.

Cross-Site Scripting (XSS) allows attacker to inject the malicious JavaScript as user input and then malicious script can access any cookies, session tokens, or other sensitive information associated with impacted applications.

Please refer https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) for more details.

Impacted URL is http://[your_webserver_ip]/opencms/system/workplace/admin/accounts/user_new.jsp

Steps to reproduce:

1. Browse to Quick Launch -> Account Management -> User Management -> New User
2. Insert TestXSS<img+src=x+onmouseover=alert(document.domain)> in First Name and Last Name field.

3. Inserted JavaScript payload will be executed on all pages where user information is displayed such as user confirmation, user list, user view etc.

Version details:

Best Regards
https://github.com/varchashva
varchashva [at] gmail [dot] com

[tHerrmann]

The user management has been re-implemented in branch_11_0_x resolving this issue. Please check the release candidate for version 11.0 to verify.

[dSeidel]

As commented, this should not be a problem in OpenCms 11 onwards, so I close the issue.