CVE-2016-5394 PoC — Apache Sling XSS Protection API模块跨站脚本漏洞

Source

https://github.com/shoucheng3/apache__sling-org-apache-sling-xss_CVE-2016-5394_1-0-8

Associated Vulnerability

Title:Apache Sling XSS Protection API模块跨站脚本漏洞 (CVE-2016-5394)
Description:In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Readme

Apache Sling XSS Bundle
====
The Apache Sling XSS Bundle provides two services for escaping and filtering XSS-prone user submitted content:

1. org.apache.sling.xss.XSSAPI
2. org.apache.sling.xss.XSSFilter

Please check the JavaDoc of each service to find out what methods they provide.

File Snapshot


 [4.0K]  /data/pocs/cb921040bf6c860df865a53c41fc2e0a498ed90e
├── [ 15K]  LICENSE
├── [ 410]  NOTICE
├── [ 12K]  pom.xml
├── [ 287]  README.md
└── [4.0K]  src
    ├── [4.0K]  main
    │   ├── [4.0K]  java
    │   │   └── [4.0K]  org
    │   │       └── [4.0K]  apache
    │   │           └── [4.0K]  sling
    │   │               └── [4.0K]  xss
    │   │                   ├── [4.0K]  impl
    │   │                   │   ├── [3.1K]  HtmlToHtmlContentContext.java
    │   │                   │   ├── [4.6K]  LongValidationRule.java
    │   │                   │   ├── [2.5K]  PlainTextToHtmlContentContext.java
    │   │                   │   ├── [2.5K]  PolicyHandler.java
    │   │                   │   ├── [3.9K]  XSSAPIAdapterFactory.java
    │   │                   │   ├── [ 16K]  XSSAPIImpl.java
    │   │                   │   ├── [9.9K]  XSSFilterImpl.java
    │   │                   │   └── [1.8K]  XSSFilterRule.java
    │   │                   ├── [6.1K]  JSONUtil.java
    │   │                   ├── [1.1K]  package-info.java
    │   │                   ├── [2.4K]  ProtectionContext.java
    │   │                   ├── [9.8K]  XSSAPI.java
    │   │                   └── [2.6K]  XSSFilter.java
    │   └── [4.0K]  resources
    │       ├── [ 23K]  ESAPI.properties
    │       ├── [4.0K]  SLING-INF
    │       │   └── [4.0K]  content
    │       │       └── [102K]  config.xml
    │       └── [1.6K]  validation.properties
    └── [4.0K]  test
        ├── [4.0K]  java
        │   └── [4.0K]  org
        │       └── [4.0K]  apache
        │           └── [4.0K]  sling
        │               └── [4.0K]  xss
        │                   └── [4.0K]  impl
        │                       ├── [ 24K]  XSSAPIImplTest.java
        │                       └── [3.6K]  XSSProtectionServiceImplTest.java
        └── [4.0K]  resources
            └── [102K]  configWithoutHref.xml

19 directories, 23 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!