topic Re: Cross Site Scripting Attacks in Alfresco Archive

Cross Site Scripting Attacks

ahamed_rasmi — Wed, 28 Apr 2010 10:49:38 GMT

Hi,We need to get approval for Security team before application be rolled out. When we sought approval, they concluded Alfresco Share is prone to Cross Site Scripting Attacks…I need help to overcome this issue and get the things going..Ver: Alfresco 3.3 Browser: IE7..Thanks in Advance

Re: Cross Site Scripting Attacks

mikeh — Wed, 28 Apr 2010 10:53:54 GMT

If you've found a reproducible bug, the correct place to log it is JIRA (see the link in my signature below).

Thanks,
Mike

Re: Cross Site Scripting Attacks

ahamed_rasmi — Thu, 29 Apr 2010 08:49:21 GMT

I posted in JIRA.. It was accepted.. But not accessible..

May i know the reason mike..? ALF-2623 is the code..

Regards,

Ahamed Rasmi

Re: Cross Site Scripting Attacks

mikeh — Thu, 29 Apr 2010 21:04:34 GMT

Generally, if an XSS or similar security issue has been identified and is reproducible, we set the JIRA issue to be accessible by Alfresco staff only - that way it's not "Googleable".

Thanks,
Mike

Re: Cross Site Scripting Attacks

ahamed_rasmi — Fri, 30 Apr 2010 04:09:41 GMT

Ok.. then how would i know about the status… and possible solutions..

Do you think UrlRewrite way with regex would solve this issue?

Regards

Ahamed

Re: Cross Site Scripting Attacks

ahamed_rasmi — Fri, 30 Apr 2010 08:56:57 GMT

I have fixed the issue.. now share site is safe..

Added a Filter..

In filter replaced the uri parameter letters like <,> into different letters.. So script tag is not executed..

Issue considered as closed..

Regards,

Ahamed