Title: Stored Cross-Site Scripting Liferay CE
CVE ID: CVE-2016-3670
CVSSv3 Base Score: 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Vendor: Liferay Inc
Advisory Release Date: 27 May 2016
Advisory URL: https://labs.integrity.pt/advisories/cve-2016-3670
Credits: Discovery by Fernando Câmara <fbc[at]integrity.pt>
Liferay is vulnerable to a stored XSS when an user is created with an malicious payload on the FirstName field.
The exploitation of this vulnerability could lead to an effective way to grab cookies (stealing sessions) from anyone that uses that search component.
Exploitation Request: (User Registration with an malicious FirstName field)
POST /liferay/web/guest/home?p_p_id=58&p_p_lifecycle=1&p_p_state= maximized&p_p_mode=view&_58_struts_action=%2Flogin%2Fcreate_account
The vulnerability is located on the users.jsp and as shown below the origin is the lack of validation of user input:
< 6.2 CE GA6
Update to version 7.0.0 CE RC1