IT04830: CROSS SITE SCRIPTING VULNERABILITIES IN QUEUE WATCHER

5.2.6.0

APAR status

• Closed as program error.

Error description

• XSS vulnerabilities reported in Queue watcher as follows:
  
  1. Reflected Cross-Site Scripting (XSS) Vulnerabilities
  (CWE-79)
  By exploiting the parameter "title", the payloads section will
  display a list of tests that show how the parameter could have
  been exploited to collect information. The path followed by the
  scanner to detect this was:
  https://<IP address>:<port #>/queueWatch/queueWatcher
  The payload was:
  title=%22'%3E%3Cqss%20%60%3b!--%3D%26%7b()%7d%3E
  The request was: GET https://<IP address>:<base +1 port
  #>/queueWatch/login.jsp?title=%22'%3E%3Cqss%20%60%3b!--%3D%26%7b
  ()%7d%3E
  
  2. Browser-Specific Cross-Site Scripting Vulnerabilities
  (CWE-79)
  By exploiting the parameter "title", the payloads section will
  display a list of tests that show how the parameter could have
  been exploited to collect information. The path followed by the
  scanner to detect this was:
  https://<IP address>:<port #>/queueWatch/queueWatcher
  The payload was:
  title=%3Cscript%20src%3Dhttp%3A%2F%2Flocalhost%2Fj%20
  The request was:  GET https://<IP address>:<port
  #>/queueWatch/login.jsp?title=%3Cscript%20src%3Dhttp%3A%2F%2Floc
  alhost%2Fj%20
  
  3. Unencoded Characters  (CWE-79)
  The web application reflects potentially dangerous characters
  such as single quotes, double quotes, and angle brackets. These
  characters are commonly used
  for HTML injection attacks, in particular cross-site scripting
  (XSS). The path followed by the scanner to detect this was:
  https://<IP address>:<port #>/queueWatch/queueWatcher
  The payload was:
  title=%3C%0a%0dscript%20a%3D4%3Eqss%3D7%3C%0a%0d%2Fscript%3E
  The request was:  GET
  https://148.93.7.238:10001/queueWatch/login.jsp?title=%3C%0a%0ds
  cript%20a%3D4%3Eqss%3D7%3C%0a%0d%2Fscript%3E
  

Local fix

• STRRTC - 444725
  NM / NA
  Circumvention: None
  

Problem summary

• Cross Site Scripting vulnerabilities in Queue Watcher.
  
  Users Affected:
  All
  
  Platforms Affected:
  All
  

Problem conclusion

• queueWatcher URL has Cross Site Scripting vulnerabilities.
  The issue is fixed.
  
  Delivered In:
  5020600
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STR B2B INTEGRA

• Fixed component ID

  5725D0600

Applicable component levels

• R526 PSY

     UP