Vulnerability in LocaleChangeInterceptor [SPR-7779] #12435
Description
Sandro Ruch opened SPR-7779 and commented
The current implementation of the LocaleChangeInterceptor does not an escaping of the value from the request. This can lead to a XSS issue if you use the standard implementation and you call:
http://someUrl?locale=%0D%0AContent-length:30%0D%0A%0D%0A%3Cscript%3Ealert%28123%29%3C/script%3E
In this case some component (which one??) of the framework will write a http-response header for the Content-language and write the provided header instead (Content-length here 30 byte) with content (here a javascript) before of the real content of the site!
Please find a patched version as attachment.
Affects: 3.0.5
Attachments:
- LocaleChangeInterceptor.java (3.43 kB)
- LocaleChangeInterceptor.patch (1.08 kB)
Issue Links:
- StringUtils.parseLocaleString(): does not parse locale string in java 7 for Serbian (Latin) [SPR-14718] #19283 StringUtils.parseLocaleString(): does not parse locale string in java 7 for Serbian (Latin)
Referenced from: commits 7af890c, f4a2282
3 votes, 5 watchers