<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><div><div>Date: 20. 9. 2023</div>Severity: High<br><div>Affected versions: 4.7, 4.7.1</div><div>Fixed in versions: 4.7.2, <span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">4.8 (unreleased)</span></div></div><div><br data-mce-bogus="1"></div><div><br>Description</div><div><br><div>Cross-site scripting (XSS) vulnerability exists in change preview and audit log of midPoint user interface, namely via organization displayName and user fullName.</div></div><div><br><div>Severity and Impact</div><div><br data-mce-bogus="1"></div><div>Malicious user can execute arbitrary scripts (e.g. Java Script) as part of midPoint web-based user interface.</div><div>This vulnerability exists in displayName for all objects, including name of the organization/organizational unit.</div><div>Exploiting this vulnerability requires administrative privileges.</div></div><div><br data-mce-bogus="1"></div><div><br><div>Mitigation</div><div><br data-mce-bogus="1"></div><div>Users of affected MidPoint versions are advised to upgrade their deployments to the latest maintenance release.</div><br><div>Discussion and Explanation</div><br><div>MIdPoint user interface is based on Apache Wicket web framework.</div><div>Proper use of Wicket web framework protects against most XSS-related vulnerabilities.</div><div>However, one part of midPoint code was using the Wicket framework improperly, therefore opening XSS vulnerability.</div><div>The vulnerability could be exploited by fabricating displayName of organizational unit, or in fact any display name of a multi-value container.</div></div><div><br data-mce-bogus="1"></div><div><br>Credit<br><div><br data-mce-bogus="1"></div><div>This issue was reported by Radically Open Security as part of NGI Zero Review program.</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>This advisory is also available at: <a href="https://docs.evolveum.com/midpoint/reference/security/advisories/019-xss-in-fullName-displayName/">https://docs.evolveum.com/midpoint/reference/security/advisories/019-xss-in-fullName-displayName/</a><br><br><pre style="color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="color: #000000; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">--
Anton Tkáčik
Software Developer
evolveum.com</pre><br data-mce-bogus="1"></div></div></div></div></body></html>