Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-1952

Crowd login form may be vulnerable to XSS attacks

XMLWordPrintable

      Details of the vulnerability:

      We have identified and fixed a cross-site scripting (XSS) vulnerability in the Crowd login form. XSS vulnerabilities potentially allow an attacker to embed their own Javascript or code into a Crowd page. An attacker's text and script might be displayed to other people viewing the Crowd page. This is potentially damaging to your company's reputation.

      This issue is reported in our security advisory on this page:
      http://confluence.atlassian.com/x/AawCDQ

      You can read more about XSS attacks at cgisecurity, CERT and other places on the web:

      Mitigation:

      If you cannot upgrade to Crowd 2.0.5 immediately, you can fix this XSS vulnerability by disallowing request parameters in generated URLs. You can globally turn off the inclusion of request parameters in generated URLs by editing your WebWork properties file:

      1. Edit the webwork.properties file located at {CROWD-INSTALLATION-DIRECTORY}\crowd-webapp\WEB-INF\classes\webwork.properties.
      2. Add the following property as a new line in the file: 
        webwork.url.includeParams=none
      3. Save the file.
      4. Restart Crowd.

      The WebWork documentation has more about the webwork.properties file.

            [CWD-1952] Crowd login form may be vulnerable to XSS attacks

            Monique Khairuliana (Inactive) made changes -
            Workflow Original: Simplified Crowd Development Workflow v2 - restricted [ 1511053 ] New: JAC Bug Workflow v3 [ 3365404 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: Simplified Crowd Development Workflow v2 [ 1393061 ] New: Simplified Crowd Development Workflow v2 - restricted [ 1511053 ]
            Owen made changes -
            Workflow Original: Crowd Development Workflow v2 [ 273707 ] New: Simplified Crowd Development Workflow v2 [ 1393061 ]
            jawong.adm made changes -
            Workflow Original: JIRA Bug Workflow v2 [ 212455 ] New: Crowd Development Workflow v2 [ 273707 ]
            SarahA made changes -
            Security Original: Reporters and Developers [ 10071 ]
            SarahA made changes -
            Description Original: We have identified and fixed a cross-site scripting (XSS) vulnerability in the Crowd login form.
            * An attacker's text and script might be displayed to other people viewing the Crowd page. This is potentially damaging to your company's reputation.

            This issue is reported in our security advisory on this page:
            http://confluence.atlassian.com/x/AawCDQ

            You can read more about XSS attacks at cgisecurity, CERT and other places on the web:
            * http://www.cgisecurity.com/xss-faq.html
            * http://www.cert.org/advisories/CA-2000-02.html             		New: *Details of the vulnerability:*

            We have identified and fixed a cross-site scripting (XSS) vulnerability in the Crowd login form. XSS vulnerabilities potentially allow an attacker to embed their own Javascript or code into a Crowd page. An attacker's text and script might be displayed to other people viewing the Crowd page. This is potentially damaging to your company's reputation.

            This issue is reported in our security advisory on this page:
            http://confluence.atlassian.com/x/AawCDQ

            You can read more about XSS attacks at cgisecurity, CERT and other places on the web:
            * http://www.cgisecurity.com/xss-faq.html
            * http://www.cert.org/advisories/CA-2000-02.html

            *Mitigation:*

            If you cannot upgrade to Crowd 2.0.5 immediately, you can fix this XSS vulnerability by disallowing request parameters in generated URLs. You can globally turn off the inclusion of request parameters in generated URLs by editing your WebWork properties file:

            # Edit the {{webwork.properties}} file located at {{\{CROWD-INSTALLATION-DIRECTORY\}\crowd-webapp\WEB-INF\classes\webwork.properties}}.
            # Add the following property as a new line in the file:
            {code}
            webwork.url.includeParams=none
            {code}
            # Save the file.
            # Restart Crowd.

            The WebWork documentation has more about the [webwork.properties|http://www.opensymphony.com/webwork/wikidocs/webwork.properties.html] file.
            SarahA made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Open [ 1 ] New: Resolved [ 5 ]
            shihab made changes -
            Description Original: We have identified and fixed a cross-site scripting (XSS) vulnerability in the Crowd login form.
            * An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's own web server.
            * An attacker's text and script might be displayed to other people viewing the Crowd page. This is potentially damaging to your company's reputation.

            This issue is reported in our security advisory on this page:
            http://confluence.atlassian.com/x/AawCDQ

            You can read more about XSS attacks at cgisecurity, CERT and other places on the web:
            * http://www.cgisecurity.com/xss-faq.html
            * http://www.cert.org/advisories/CA-2000-02.html             		New: We have identified and fixed a cross-site scripting (XSS) vulnerability in the Crowd login form.
            * An attacker's text and script might be displayed to other people viewing the Crowd page. This is potentially damaging to your company's reputation.

            This issue is reported in our security advisory on this page:
            http://confluence.atlassian.com/x/AawCDQ

            You can read more about XSS attacks at cgisecurity, CERT and other places on the web:
            * http://www.cgisecurity.com/xss-faq.html
            * http://www.cert.org/advisories/CA-2000-02.html
            David O'Flynn [Atlassian] made changes -
            Description Original: We have identified and fixed a cross-site scripting (XSS) vulnerability in the Crowd login form.
            * An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's own web server.
            * An attacker's text and script might be displayed to other people viewing the Confluence page. This is potentially damaging to your company's reputation.

            This issue is reported in our security advisory on this page:
            http://confluence.atlassian.com/x/AawCDQ

            You can read more about XSS attacks at cgisecurity, CERT and other places on the web:
            * http://www.cgisecurity.com/xss-faq.html
            * http://www.cert.org/advisories/CA-2000-02.html             		New: We have identified and fixed a cross-site scripting (XSS) vulnerability in the Crowd login form.
            * An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's own web server.
            * An attacker's text and script might be displayed to other people viewing the Crowd page. This is potentially damaging to your company's reputation.

            This issue is reported in our security advisory on this page:
            http://confluence.atlassian.com/x/AawCDQ

            You can read more about XSS attacks at cgisecurity, CERT and other places on the web:
            * http://www.cgisecurity.com/xss-faq.html
            * http://www.cert.org/advisories/CA-2000-02.html
            SarahA created issue -

              Unassigned Unassigned
              smaddox SarahA
              Affected customers:
              0 This affects my team
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: