Bug 329582 - [Webapp][Security] Eclipse Help Server XSS
Summary: [Webapp][Security] Eclipse Help Server XSS
Status: RESOLVED FIXED
Alias: None
Product: Platform
Classification: Eclipse Project
Component: User Assistance (show other bugs)
Version: 4.1   Edit
Hardware: PC other
: P3 major (vote)
Target Milestone: 3.7 M4   Edit
Assignee: Chris Goldthorpe CLA
QA Contact:
URL:
Whiteboard:
Keywords: security
Depends on:
Blocks: 330026
  Show dependency tree
 
Reported: 2010-11-05 15:35 EDT by YGN Ethical Hacker Group CLA
Modified: 2011-09-29 16:41 EDT (History)
5 users (show)

See Also:

Attachments
Patch (2.60 KB, patch)
2010-11-08 14:35 EST, Chris Goldthorpe CLA 		no flags Details | Diff
Patch for 3.5 maintenance stream (3.54 KB, patch)
2011-02-16 16:53 EST, Chris Goldthorpe CLA 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description YGN Ethical Hacker Group CLA 2010-11-05 15:35:56 EDT 
Build Identifier: 20100917-0705

The /help/index.jsp and /help/advanced/content.jsp URLs are vulnerable to Cross Site Scripting. XSS with /help/advanced/content.jsp url makes the browser hang but even after clicking "Stop Executing" button, users can still get XSS. 

See the sample exploit.

http://yehg.net/lab/pr0js/advisories/eclipse/helios/help_server_xss/eclipse_ie_xss_demo.htm


.



Reproducible: Always

Steps to Reproduce:
1. Open "Help Contents" under Help menu of Eclipse
2. Note its random port number by seeing status bar of Help Window
3. Request the follow urls with Internet Explorer

http://localhost:[REPLACE]/help/index.jsp?'onload='alert(0)
http://localhost:[REPLACE]/help/advanced/content.jsp?'onload='alert(0)

Replace [REPLACE] with your own port number.
Comment 1 Chris Goldthorpe CLA 2010-11-08 14:35:40 EST 
Created attachment 182653 [details]
Patch

There are two problems uncovered by this bug. This patch fixes the major problem, which is the XSS vulnerability. The other less serious issue is described in Bug 329699 - [Webapp] Opening /help/advanced/content.jsp causes unresponsive script.
Comment 2 Chris Goldthorpe CLA 2010-11-08 14:42:08 EST 
Patch applied to HEAD, Fixed
Comment 3 Chris Goldthorpe CLA 2010-11-08 14:42:56 EST 
Resolving as Fixed
Comment 4 Chris Goldthorpe CLA 2011-02-16 16:53:17 EST 
Created attachment 189137 [details]
Patch for 3.5 maintenance stream

I have applied this patch to the 3.5 maintenance stream.
Comment 5 David Klein CLA 2011-02-18 10:40:04 EST 
Requesting that a patch be provided for 3.4.2 as this is the version our products are currently using.  Our next release will be on the 3.6.x level.  Will the 3.5 stream patch work for 3.6.2?  Also, we have releases still under service that use 3.4 as well as 3.2.2.  Hopefully a patch for 3.4.2 would essentially be the same for 3.4.  I realize 3.2.2 is another story.
Comment 6 Chris Goldthorpe CLA 2011-02-18 12:00:58 EST 
I've applied to the 3.4 maintenance stream the same patch as was applied to the 3.5 maintenance stream
Comment 7 John Arthorne CLA 2011-06-10 14:21:56 EDT 
Removing security restriction for bugs that have been fixed in 3.6.2 or earlier.