Symptoms:
A Cross-site scripting (XSS) vulnerability in App Portal 2018 R1 and earlier allows remote attackers to inject arbitrary web script or HTML via the note context parameter.
Cause
Request validation is disabled on the request details page, and this exposes the XSS vulnerability.
Solution:
This issue has been resolved in App Portal 2019 R1. Please download the latest version of App Portal 2019 R1 from the PLC download area.
Workaround:
This issue can be worked around, by opening the file <install dir>/web/web.confg, and removing the following section from the file:
<location path="RequestDetails.aspx">
<system.web>
<pages validateRequest="false" />
<httpRuntime requestValidationMode="2.0" />
</system.web>
</location>
Additional Information:
This issue has been tracked under issue number IOJ-1906238.
For release notes and resolved issues with App Portal 2019 R1, please visit:
https://helpnet.flexerasoftware.com/appportal/rn2019r1/AppPortalAppBroker2019r1ReleaseNotes.htm#resolve
Related Documents:
Secunia Research at Flexera has issued an advisory SA88121.
A copy of the advisory is attached to this article.
