XSS in terminal

[cnsgithub]

1) Environment

• PrimeFaces version: 6.3-SNAPSHOT

2) Expected behavior

Proper escaping of command handler result

3) Actual behavior

Improper escaping

4) Steps to reproduce

Go to modified showcase (http://localhost:8080/showcase/ui/misc/terminal.xhtml), enter a command and press enter. Alert containing session cookie (btw, use HttpOnly flag in showcase?) will be shown. Content will be deleted.

5) Sample XHTML

Unmodified showcase

6) Sample bean

Modified showcase:

    public String handleCommand(String command, String[] params) {
        return "foo]]></update><update id=\"CONTENTSIDE\"><![CDATA[<script>alert(document.cookie);</script>]]></update><update><![CDATA[bar";
    }

7) Mitigation

PR will follow. @tandraschko Same procedure as every time? (Schönen Brückentag noch. 🍺 )

[cnsgithub]

Oops, this may be a general problem with PrimePartialResponseWriter or even with PartialResponseWriter (Mojarra).

CDATA section delimiters can be injected, see https://www.owasp.org/index.php/Testing_for_XML_Injection_(OTG-INPVAL-008).

[cnsgithub]

PR: #3628

CDATA stuff has to be examined separately in more detail.