PK83866: REQWEB IS VULNERABLE TO CROSS-SITE SCRIPTING

Rational RequisitePro, version 7.1.0.2, Interim Fix 1

APAR status

• Closed as program error.

Error description

• ReqWeb is vulnerable to Cross-Site Scripting attacks.  The follo
  wing links demonstrate the problem.
  
  http://localhost/ReqWeb/Doc_Frame.jsp?--??/script??script?alert(
  37186)?/script?
  
  http://localhost:9080/ReqWeb7/ProjInfo_Page.jsp??PackageID=187';
  alert(3445);//?viz=1236358927875
  
  http://localhost:9080/ReqWeb7/Doc_Frame.jsp?DocAction=21'+alert(
  3200)+'?DocKey=null
  
  The above examples result in an Alert box appearing which shows
  the script can be run against ReqWeb.  This allows for potential
   attacks against the site.  These types of attacks should be blo
  cked to prevent attacks of this type.
  

Local fix

Problem summary

• It is possible to execute script code against RequisitePro
  Web Client that should not be allowed to be execute.  The
  following is an example:
  
  http://localhost/ReqWeb/Doc_Frame.jsp?--??/script??script?al
  ert(37186)?/script?
  

Problem conclusion

• The code has been modified to process script like the
  example provided and prevent it from being executed.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  REQUISITEPRO WI

• Fixed component ID

  5724G3900

Applicable component levels

• R710 PSN

     UP