Preetam Ray
Top achievements
Rank 1
Rank 1
Preetam Ray
asked on 01 Feb 2010, 05:43 PM
Recently we had our application scanned by the IBM App Rational Scan and in the scan we found that there were a number of XSS vulnerabilities due to Telerik controls.
The scan tried to successfully inject a script in the response and it was getting rendered?
Is there any possible solution that Telerik suggests to overcome this problem?
Script value of something like this shown below was injected.
<script>alert(176113)</script>
The scan tried to successfully inject a script in the response and it was getting rendered?
Is there any possible solution that Telerik suggests to overcome this problem?
Script value of something like this shown below was injected.
<script>alert(176113)</script>
3 Answers, 1 is accepted
0
Hello Preetam Ray,
There was such problem with the RadScriptManager control and it is already fixed. Please update to the latest RadControls for ASP.NET AJAX version(2009.3.1314) or remove the RadScriptManager from your project.
We used the same tool to scan the latest version and everything seems to be fine.
Greetings,
Petio Petkov
the Telerik team
Watch a video on how to optimize your support resource searches and check out more tips on the blogs.
Follow the status of features or bugs in PITS and vote for them to affect their priority.
There was such problem with the RadScriptManager control and it is already fixed. Please update to the latest RadControls for ASP.NET AJAX version(2009.3.1314) or remove the RadScriptManager from your project.
We used the same tool to scan the latest version and everything seems to be fine.
Greetings,
Petio Petkov
the Telerik team
Watch a video on how to optimize your support resource searches and check out more tips on the blogs.
Follow the status of features or bugs in PITS and vote for them to affect their priority.
0
Preetam Ray
Top achievements
Rank 1
Rank 1
answered on 02 Feb 2010, 08:56 PM
Ok. But, is there an alternate solution to this. Other than upgrading to the new rad controls any code fix that could help solve the issue as upgrading means missing out few methods, properties etc,
0
Hello Preetam,
Unfortunately there is no temporary workaround with previous versions. If you would like to address the security vulnerability, you should either upgrade to the latest Q3 2009 SP2 release or replace RadScriptManager with regular asp ScriptManager control.
Kind regards,
Sebastian
the Telerik team
Watch a video on how to optimize your support resource searches and check out more tips on the blogs.
Follow the status of features or bugs in PITS and vote for them to affect their priority.
Unfortunately there is no temporary workaround with previous versions. If you would like to address the security vulnerability, you should either upgrade to the latest Q3 2009 SP2 release or replace RadScriptManager with regular asp ScriptManager control.
Kind regards,
Sebastian
the Telerik team
Watch a video on how to optimize your support resource searches and check out more tips on the blogs.
Follow the status of features or bugs in PITS and vote for them to affect their priority.