Cross-site Scripting (XSS) Vulnerability in Report Viewer

[Bill]

Hi there!

We’ve identified that the reporting component returns verbose error messages with a 200 HTTP status code, making our application vulnerable to XSS attacks. 

Please could you contact us privately, as soon as possible for more details.

Thanks, in advance.

[Robbie Hughes]

Hi there

Could someone from Telerik please answer this question?

Thanks

[Chavdar]

Hi guys,

The report viewer communicates only with its http handler which returns verbose error messages only when there is a problem while processing or rendering the reports. In this way the web application is protected as the attacker cannot gain access to sensitive data by sending requests to the report viewer's handler.

Kind regards,
Chavdar
the Telerik team

[Bill]

Hi Chavdar

Thanks for your reply. I am sorry for my late response!

Unfortunately your answer doesn't address our concern. In order to be specific about why, we would rather email the details than post security flaws about our software on the web. To that end, please could you provide us with an email address that we can use to send the results from our penetration testing?

Many thanks

[Peter]

Hi Bill,

Our suggestion is to open a general feedback thread.

All the best,
Peter
the Telerik team

[Ervinna]

Hi There,

I am using Telerik 2011_2_712 to develop project.
But Telerik does not pass the penetration test. 
I have a list of issue found which causes the penetration test fail in Excel file.
How can i send you the file?
Is it being fixed?

Thanks.

[Ervinna]

Hi all,

Is anyone facing the same problem which telerik did not pass the penetration test?

[Bill]

Hi Ervinna

We had problems with this too, as you can see on earlier posts. Telerik advised us to report via an open feedback thread (link in Peter's post).

Cheers

Bill