HTML Injection

[Bhagwan Gupta, geändert vor 9 Jahren.]

During add the content intercept the request using http proxy then add value """:/>www.google.com in the_struts_action field

Now forward the request and it can be seen every content link will be changed in the displaying response.


we need some solution that,nobody can change the url,if try to change the url ,throgh the request/response to the error page .


Regards,
B D Gupta

[David H Nebinger, geändert vor 9 Jahren.]

wth?

[Bhagwan Gupta, geändert vor 9 Jahren.]

Hi,

Hacker intercept the request using http proxy then add the value like ("""/>www.google.com)in struts_action field .

after forward this modified request,when get the response then every link in page have like this

www.google.com&_82_redirect=%2

for detail u can see the attached image.


Basically ,we are facing HTML injection vulnerability,Kindly help to close on this.


Regards,
Bhagwan das

[Tomas Polesovsky, geändert vor 8 Jahren.]

Hi,

I cannot verify your issue, what portal version do you use? Do you have CE or EE?

To verify I'd need to see the HTML output when the parameter is changed.

Thanks.

[Bhagwan Gupta, geändert vor 8 Jahren.]

Hi,

I am using liferay 6.1.0 CE GA1.

Thanks

[David H Nebinger, geändert vor 8 Jahren.]

Well first that's probably not a live injection, it's probably in the database and you'll need to dive into the DB and start scrubbing.

Second, if you've stood up a CE environment on the net and have not kept up with updates (i.e. 6.1.0 is at GA3), well then you've been asking to get hacked and someone just happened to step up.

Third, regardless what people may believe, CE is really not suitable for direct internet usage. There just aren't enough releases in a quick enough cycle to address security issues. CE development has moved on to the 6.2 release and currently is focused on the 7.0 release. No one is going back to apply security fixes to 6.1 CE to issue another 6.1 version - it just doesn't happen.

EE is truly the only option for internet options. If you had EE, you could stay at the 6.1 release and get security updates and patches to deal with vulnerabilities.

But saying on a really old version and ignoring patch releases that are available? Well basically you've dug yourself a hole and climbed in, so you really can't complain when the dirt is thrown in...

[Paul Allain, geändert vor 8 Jahren.]

David H Nebinger:

Third, regardless what people may believe, CE is really not suitable for direct internet usage. There just aren't enough releases in a quick enough cycle to address security issues.
...
EE is truly the only option for internet options. If you had EE, you could stay at the 6.1 release and get security updates and patches to deal with vulnerabilities.

Are you saying that CE is not fit for purpose?

The community is probably Liferay's most valuable asset as they are testing the software and contributing in other ways to keep the portal in good health.

Here is a strategic issue that need to be addressed such as to give CE users incentives to use the postal software in real life situations. The way I see it is that if there is no community there would be no Liferay portal.

Paul

[David H Nebinger, geändert vor 8 Jahren.]

Paul Allain:

David H Nebinger:

Third, regardless what people may believe, CE is really not suitable for direct internet usage. There just aren't enough releases in a quick enough cycle to address security issues.
...
EE is truly the only option for internet options. If you had EE, you could stay at the 6.1 release and get security updates and patches to deal with vulnerabilities.

Are you saying that CE is not fit for purpose?

Yes and no?

The general GAs languish a bit holding security fixes back until the platform stabilizes. Patches can be pulled earlier from the security team site and applied on your own, but you have to track them and keep up to date.

Personally I think EE is a better product for internet facing sites, but admittedly that is my opinion.

If you track the CST site and apply every patch they give you and stay as up to date as possible, you may be okay. If you're lazy or uncommitted, you're asking for trouble, just like the OP who got himself violated.

[Paul Allain, geändert vor 8 Jahren.]

David H Nebinger:

Personally I think EE is a better product for internet facing sites, but admittedly that is my opinion.

Well I'm glad EE is better than CE, otherwise your paying customers would be really worried. In any case I am relieved that it's your personal opinion as opposed to a real fact.

[James Falkner, geändert vor 8 Jahren.]

Paul Allain:

Are you saying that CE is not fit for purpose?

The community is probably Liferay's most valuable asset as they are testing the software and contributing in other ways to keep the portal in good health.

Here is a strategic issue that need to be addressed such as to give CE users incentives to use the postal software in real life situations. The way I see it is that if there is no community there would be no Liferay portal.

Paul

Hey Paul - when we release CE we believe it to be suitable for production use - otherwise we would not release it. It meets the needs of thousands of external-facing sites. This is a typical commercial open source arrangement and one we wholeheartedly believe in (it's in the company tagline and where the project started - EE didn't even exist until 2008). For companies that want extra professional support, legal protections, etc, they go with EE.

CE is not a "bait and switch" where we put buggy software out there in the hopes you use it, find issues, and are strong-armed into EE. Liferay started and continues to believe in open source and the power of our open source communities - if it did not, I would find a new job.

But as David says, you should not ignore updates from software vendors (Liferay or otherwise). We release a new CE every 6 months with fixes (most notably all security fixes, as well as other issues identified and/or fixed by our community) and in between the official releases our Community Security Team regularly releases patches for CE to fix flaws as we strongly believe in doing our best ethically to keep our software secure and keep production CE sites safe.

Of course Liferay (and every other software package) has bugs, and it's users like you who have found Liferay and use it in the "critical path" of business (i.e. production sites) that help us improve the software so that it is more useful, even for those with little or no money and cannot afford professional support. We love making slides with hundreds of logos of small companies and organizations that use Liferay every day and pay us nothing. It's literally baked into the company's DNA.

[Paul Allain, geändert vor 8 Jahren.]

Hey James,

First, thank for your reply.

Also I think your answer is spot on and it's exactly why I have adopted Liferay as part of my overall enterprise architecture. I don't necessarily want to dwell too long on open-source and its benefits but I want to confirm that the fact that Liferay comes as a dual offering (open-source and enterprise) is the main reason for my choice so that if/when I'm ready to scale I could flick the switch.

From my perspective (and undoubtedly that of many of your users) there isn't such a thing as free software, for example Liferay community portal can be picked up at no actual cost but the steep learning curve and the initial setup cost as well as the ongoing maintenance are not free, I guess what I'm trying to say is that for all enterprises large and small it'a about TCO.

Although I have played with Liferay for a number of years, only recently have I taken it seriously and hope to continue on with my journey with the portal. I intend to buid a certain level of expertise and, who knows, even contribute something back.

Eventually and when it makes business sense every serious Liferay user needs to go enterprise or spend as much if not more to build their internal team to provide support for the ongoing platform.

BTW, I've just discovered the dev.life Hangout that you host and I think it's a great idea. Hope you'll be schedulling more session for the forthcoming future.

Cheers
Paul

[James Falkner, geändert vor 8 Jahren.]

Paul Allain:

Hey James,

First, thank for your reply.

Also I think your answer is spot on and it's exactly why I have adopted Liferay as part of my overall enterprise architecture. I don't necessarily want to dwell too long on open-source and its benefits but I want to confirm that the fact that Liferay comes as a dual offering (open-source and enterprise) is the main reason for my choice so that if/when I'm ready to scale I could flick the switch.

Yes, that's correct - you can use CE and when you're "ready" (i.e. you have a need and money), you can buy an enterprise subscription (which entitles you to use EE and get all the plugins, indemnification, support SLAs, etc).

From my perspective (and undoubtedly that of many of your users) there isn't such a thing as free software, for example Liferay community portal can be picked up at no actual cost but the steep learning curve and the initial setup cost as well as the ongoing maintenance are not free, I guess what I'm trying to say is that for all enterprises large and small it'a about TCO.

Yep, spon on. Software isn't free but if you're willing to DIY you can save at least on the subscription/license costs. But the more you have to lose, the more support you will want.

Although I have played with Liferay for a number of years, only recently have I taken it seriously and hope to continue on with my journey with the portal. I intend to buid a certain level of expertise and, who knows, even contribute something back.

That would be awesome - I'm glad you're taking a more serious look. Liferay isn't perfect, there are dark, unexplored corners of the project, but I think our community is one of the friendliest and most inviting out there. So if you run into issues (and you will), there are many here that have already been down that road and are willing to help.

Eventually and when it makes business sense every serious Liferay user needs to go enterprise or spend as much if not more to build their internal team to provide support for the ongoing platform.

Yep, agreed. Isn't it cool that you have that freedom?

BTW, I've just discovered the dev.life Hangout that you host and I think it's a great idea. Hope you'll be schedulling more session for the forthcoming future.

Yeah - we're going to restart that machine in about 2 weeks in the run up to the Liferay 7 release with some cool sessions on dev tooling. Stay tuned!

[Paul Allain, geändert vor 8 Jahren.]

Thanks for taking the time to reply and good new about Liferay 7 and dev.life "new season", looking forward to it.