Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0014858Openbravo ERPC. Securitypublic2010-10-12 01:472022-02-01 08:08
Reportercmlh_id_au 
Assigned ToTriage Platform Base 
PriorityhighSeveritymajorReproducibilityalways
StatusacknowledgedResolutionopen 
PlatformOS20OS VersionCommunity Appliance
Product Version 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0014858: Cross Site Scripting (XSS) - Reflected - UserRoles _Edition.html - "inpadUserId" Parameter
DescriptionThe value of the "inpadUserId" Parameter is not validated and/or escaped during the HTTP GET Request of /openbravo/User/UserRoles_Edition.html and hence is vulnerable to Reflected Cross Site Scripting (XSS)
Steps To ReproduceOpenbravoERP-2.50MP22-x86.vmware.zip was used to reproduce the Reflected XSS

1. Substitute the value for [FQDN] below and then copy and paste the following URL into Firefox after authenticating to OpenbravoERP VM:

http://[FQDN]/openbravo/User/UserRoles_Edition.html?inpAccessLevel=6&Command=&urlwin=UserRoles_Edition.html&inpTabId=121&inpTableId=157&inpadUserId=100%22%3E%3Cimg%20src%3da%20onerror%3dalert%28%27XSS%27%29%3E&inpkeyColumnId=AD_User_Roles_ID&inpadUserRolesId=&inpKeyName=inpadUserRolesId&inpwindowId=108&inpParamSessionDate= [^]

2. A Javascript Alert Box will display "XSS" as per the attached screenshot.
Proposed SolutionValidate and escape the value of the "inpadUserId" Parameter on the server side i.e. prior to the Javascript being executed by the web browser.
Additional Information
TagsNo tags attached.
Relationships
blocks design defect 0019842 acknowledged Triage Platform Base Review Cross-site Scripting 
Attached Filesjpg Cross_Site_Scripting_(XSS)_-_Reflected_-_ UserRoles_Edition.html_-_inpadUserId_Parameter.jpg (75,472) 2010-10-12 01:47
https://issues.openbravo.com/file_download.php?file_id=3216&type=bug
jpg
Issue History
Date ModifiedUsernameFieldChange
2010-10-12 01:47cmlh_id_auNew Issue
2010-10-12 01:47cmlh_id_auAssigned To => alostale
2010-10-12 01:47cmlh_id_auFile Added: Cross_Site_Scripting_(XSS)_-_Reflected_-_ UserRoles_Edition.html_-_inpadUserId_Parameter.jpg
2010-10-12 01:47cmlh_id_auIssue Monitored: cmlh_id_au
2010-10-25 08:56alostaleAssigned Toalostale => shuehner
2010-10-25 08:56alostaleStatusnew => scheduled
2012-02-20 11:20shuehnerAssigned Toshuehner => alostale
2012-02-22 15:52alostaleRelationship addedblocks 0019842
2012-02-22 15:54alostaleOBNetwork customer => No
2012-02-22 15:54alostaleTypedefect => design defect
2012-09-24 23:25AugustoMauchNote Added: 0052466
2012-09-24 23:25AugustoMauchPrioritynormal => high
2017-03-31 14:36alostaleStatusscheduled => acknowledged
2017-04-10 14:34alostaleAssigned Toalostale => platform
2022-02-01 08:08alostaleAssigned Toplatform => Triage Platform Base

Notes
(0052466)
AugustoMauch   
2012-09-24 23:25   
Effort: 1
Impact: low
Plan: short