XSS Vulnerability on Request Details when Adding Notes to a Request
A Cross-site scripting (XSS) vulnerability in App Portal 2018 R1 and earlier allows remote attackers to inject arbitrary web script or HTML via the note context parameter.
Request validation is disabled on the request details page, and this exposes the XSS vulnerability.
This issue has been resolved in App Portal 2019 R1. Please download the latest version of App Portal 2019 R1 from the PLC download area.
This issue can be worked around, by opening the file <install dir>/web/web.confg, and removing the following section from the file:
<pages validateRequest="false" />
<httpRuntime requestValidationMode="2.0" />
This issue has been tracked under issue number IOJ-1906238.
For release notes and resolved issues with App Portal 2019 R1, please visit:
Secunia Research at Flexera has issued an advisory SA88121.
A copy of the advisory is attached to this article.