[FELIX-6132] XSS possible in service console

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: webconsole-4.3.8
• Fix Version/s: webconsole-4.3.12
• Component/s: Web Console
• Assignee: Karl Pauls
• Reporter: Ashok Kumar
• Created: 17/May/19 10:16
• Updated: 27/May/19 11:55
• Resolved: 20/May/19 10:53

Description

Issue Summary : There is a XSS possible in system console.

Steps to reproduce :

1. Open a local instance
2. Open the link http://localhost:4502/system/console/services?filter=%22onmouseover=%22alert(%27xss%27)%22 in Internet Explorer. A pop would come when you mouse over the filter input box.
3. Chrome would auto flag XSS exploit and prevent page load

Expected Behavior : The pop up should not come up.

Issue Links

• supercedes: FELIX-4746 Escape outputting filter parameter in service servlet