[SLING-2974] XSS vulnerability in AbstractAuthenticationFormServlet

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Auth Core 1.1.2
• Fix Version/s: Auth Core 1.1.4
• Component/s: Authentication
• Assignee: Carsten Ziegeler
• Reporter: Julian Sedding
• Created: 18/Jul/13 11:00
• Updated: 07/Oct/13 14:04
• Resolved: 19/Jul/13 06:49

Description

The AbstractAuthenticationFormServlet replaces placeholders in an HTML page with user-provided input without taking care of proper escaping of the input. Hence it is possible to construct an XSS-attack exploiting this servlet.

This is made worse by the fact that this servlet doesn't provide an obvious way to disable it. Setting the sling.servlet.path="-" using content based configuration did the trick in my case, however.