Cross-site scripting - vulnerability scan

[Steve]

We have an issue with our security scans that highlight a lot cross-site issues in Telerik. They are using version 2009.1.402.0. I need to find a release with this fixed.

Here is a sample.

============================================================================

2. Cross-site scripting (reflected)

Summary
Severity:   High
Confidence:   Certain
Host:   https://www.xxx.com
Path:   /atlas/Telerik.Web.UI.WebResource.axd

Issue detail
The value of the _TSM_HiddenField_ request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 50c33'%3balert(1)//8f999a4adfd was submitted in the _TSM_HiddenField_ parameter. This input was echoed as 50c33';alert(1)//8f999a4adfd in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

=========================================================================================

I have searched release notes and I have not been able to find a fix for this issue.

[Kamen Bundev]

Hi Steve,

Yes, this issue was fixed some time ago. Can you check if upgrading to the latest release of RadControls for ASP.NET AJAX fixes it for you?

All the best,
Kamen Bundev
the Telerik team

[Steve]

In what version was this fixed?

[Kamen Bundev]

Hi Steve,

The fix was rolled out in Q3 2009 SP2.

All the best,
Kamen Bundev
the Telerik team

[Harold]

We are using version 2009.3.1121.20 of the Telerik.Web.UI DLL.  We failed a penetration test for cross site scripting and when we switched the telerik:RadScriptManager to asp:ScriptManager we passed the penetration test.  Can you tell me which version of your suite fixed this issue.  This is a ASP.NET 2.0 application so we cannot use the most current version of your tools.
Thanks, Harold

[Simon]

Hi Harold,

I looked through the release notes up until now and could not find any specific mention of this issue. Is it possible for you to just upgrade to a more recent version to test for yourself whether the issue got resolved? I suggest you do that incrementally, first with the 2010.1 release and then with the next official release until 2011.1 (this one does not have a .net 2.0 build so it will not be useful to you).

I hope this helps.

All the best,
Simon
the Telerik team