Torbjørn Skyberg Knutsen created AMQ-7231:
---------------------------------------------
Summary: XSS in webconsole
Key: AMQ-7231
URL: https://issues.apache.org/jira/browse/AMQ-7231
Project: ActiveMQ
Issue Type: Bug
Components: webconsole
Affects Versions: 5.15.6
Reporter: Torbjørn Skyberg Knutsen
The admin GUI is very much open to XSS, in the view that lists the contents of
a queue.
Using Camel, here is the code required to make the GUI run JavaScript-code:
{code:java}
messageQueue.sendBodyAndHeader("activemq:hack", "body", "hack",
"hello}\"><script>alert('XSS :(');</script>");
{code}
This also happens when you have a header containing xml, where an element holds
an attribute:
{code:java}
messageQueue.sendBodyAndHeader("activemq:hack", "body", "hack", "<Something
something=\"something\">hello</noe>><script>alert('XSS :(');</script>");
{code}
Seems to be due to how the title of the message is generated. This last one
also messes up the way a message is displayed in the list, since it will start
displaying the xml content after the attribute as HTML.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
