Restrictions on this page This page is editing restricted to release engineers, uPortal developers, and a few other groups because it is security-related and distributes a security patch file.

Status of this vulnerability

This is a verified vulnerability. This page exists to document how to patch to close this vulnerability in your local uPortal 2.6 environment.

A forthcoming uPortal 2.6.1.1 release will consist of uPortal 2.6.1 with this patch pre-applied. This page exists to allow you to apply this patch before that release is available and to provide an alternative to adopting that release (you may find the patching described here more convenient).

A forthcoming uPortal 2.6.2 release will include this patch alongside other fixes and enhancements.

This vulnerability also affects uPortal 3.0.0. There is another wiki page documenting working around the vulnerability in that context.

Vulnerability in a Nutshell

uPortal 2.6.1 and earlier ships with an HttpProxyServlet implementation that is broken in that it will proxy non-image content. This can result in an illicit proxy through the deployed uPortal that constitutes a serious security vulnerability, potentially making cross-site-scripting attacks including session stealing feasible.

It is important that all uPortal deployments remedy this vulnerability in their local environment.

Technical details of vulnerability

This vulnerability is documented as Jira issue UP-2088

How to remedy this vulnerability

If you're not using the HttpProxyServlet

Comment out or delete outright this servlet's declaration and configuration in your uPortal web.xml and restart Tomcat to remove it from the environment. Ensure that your local web.xml continues to not include this servlet across future deployments (i.e., also fix this in your local source if you might ever re-deploy your uPortal using the build process).

The Jira entry for this issue has an attached patch making this change.

Here's what the relevant portions of your web.xml end up looking like:

<servlet>
    <servlet-name>Logout</servlet-name>
    <servlet-class>org.jasig.portal.LogoutServlet</servlet-class>
    <load-on-startup>3</load-on-startup>
  </servlet>

<!-- Uncomment this servlet and the corresponding servlet-mapping if ProxyWriter is enabled in portal.properties
  <servlet>
    <servlet-name>HttpProxyServlet</servlet-name>
    <servlet-class>org.jasig.portal.HttpProxyServlet</servlet-class>
  </servlet>
  -->  

...

  <servlet-mapping>
    <servlet-name>Logout</servlet-name>
    <url-pattern>/Logout</url-pattern>
  </servlet-mapping>

<!-- Uncomment this servlet-mapping and the corresponding servlet if ProxyWriter is enabled in portal.properties
  <servlet-mapping>
    <servlet-name>HttpProxyServlet</servlet-name>
    <url-pattern>/servlet/ProxyServlet/*</url-pattern>
  </servlet-mapping>
-->

A web.xml with the servlet declaration and mapping commented out is also attached to this page.

Removing this servlet from service in your portal environment is sufficient to block this vulnerability. However, if you may wish to use the servlet in the future, you may wish to also fix the HttpProxyServlet Java class as discussed below.

If you are using HttpProxyServlet

A simple code fix to HttpProxyServlet.java will block this vulnerability. (It's a matter of fixing HttpProxyServlet to have the code execution path it was intended to have. This patch fixes an unfortunate bug.)

The Jira entry for this issue has an attached patch which shows how to fix HttpProxyServlet.java. HttpProxyServlet is also fixed in the tip of the Subversion source control for the uPortal 2.6 branch.

Attached to this page is an HttpProxyServlet.class file compiled under JDK 1.5 (Java 5) implementing this fix.

	Name	Size	Creator (Last Modifier)	Creation Date	Last Mod Date	Comment
	HttpProxyServlet.class	5 kb	Andrew Petro	Jun 17, 2008	Jun 17, 2008	HttpProxyServlet compiled from revision 43891 of uPortal 2.6 patches branch
	web.xml	5 kb	Andrew Petro	Jun 17, 2008	Jun 17, 2008	web.xml with proxy servlet commented out

To fix this issue, you can drop the HttpProxyServlet.class file your deployed uPortal environment, replacing the existing HttpProxyServlet.class

{tomcat}/webapps/uPortal/WEB-INF/classes/org/jasig/portal/HttpProxyServlet.class

You should also fix this in your local source environment so that if you should re-compile or re-deploy uPortal, your environment will include this fix.