Bug 58267 - Cross Site Scripting (XSS) in UDM via crafted LDAP RDNs
Summary: Cross Site Scripting (XSS) in UDM via crafted LDAP RDNs
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: UMC - Domain management (Generic)
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.2-0-errata
Assignee: Dirk Wiesenthal
QA Contact: Iván.Delgado
URL:
Keywords:
Depends on: 49001 58268
Blocks:
  Show dependency tree / graph
 
Reported: 2025-05-13 15:48 CEST by Dirk Wiesenthal
Modified: 2025-05-14 15:27 CEST (History)
4 users (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Customer ID:
Max CVSS v3 score: 6.2 (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dirk Wiesenthal univentionstaff 2025-05-13 15:48:45 CEST 
Clone for 5.2-0. I don't want to release the complete 5.2-1 version, it has some delegate admin feature code in it.

+++ This bug was initially created as a clone of Bug #49001 +++

# udm container/cn create --set name='<span onmouseover="alert(document.cookie)">foo</span>'
Object created: cn=\<span onmouseover\=\"alert(document.cookie)\"\>foo\</span\>,dc=dev,dc=local

→ Open the LDAP Directory
At least three vulnerable places: 1. the tree; 2. the Search-Grid, 3. the Remove dialog.

The detail page of this object and subobjects of it seems to be okay.
Comment 1 Dirk Wiesenthal univentionstaff 2025-05-13 15:49:34 CEST 
Hmm... cannot choose 5.2-0-errata. Hopefully, this still works
Comment 2 Dirk Wiesenthal univentionstaff 2025-05-14 10:36:23 CEST 
univention-web.yaml
bae2b9e6f60b | Bug #58267: Fix various Cross Site Scripting (XSS) vulnerabilities in UDM via crafted LDAP RDNs and other attributes

univention-web (6.0.8-1)
10f40e10fb8d | Bug #58267: Fix changelog having the wrong bug number
bae2b9e6f60b | Bug #58267: Fix various Cross Site Scripting (XSS) vulnerabilities in UDM via crafted LDAP RDNs and other attributes

univention-management-console-module-udm.yaml
bae2b9e6f60b | Bug #58267: Fix various Cross Site Scripting (XSS) vulnerabilities in UDM via crafted LDAP RDNs and other attributes

univention-management-console-module-udm (12.0.4-1)
10f40e10fb8d | Bug #58267: Fix changelog having the wrong bug number
bae2b9e6f60b | Bug #58267: Fix various Cross Site Scripting (XSS) vulnerabilities in UDM via crafted LDAP RDNs and other attributes
Comment 3 Iván.Delgado univentionstaff 2025-05-14 11:56:24 CEST 
QA:
 Code review: OK
 Detail page: OK
 Tree view: OK
 Delete dialog: OK
 Advisory: OK
 Test: OK