IT36871: CROSS SCRIPTING SECURITY VULNERABILITY IN HATS

IBM Host Access Transformation Services Fix Pack 2 (9.7.0.2) for 9.7

APAR status

• Closed as program error.

Error description

• The support for X-XSS-Protection header is removed from the
  latest version of the browsers. This is causing an issue with
  CSRF Cross Scripting when using HATS.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All HATS users                                               *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * While running a HATS application, users were able to         *
  * successfully inject a malicious script through input         *
  * parameters.                                                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  1. Create a HATS web project
  2. While running the project in the browser, try to inject a
  malicious script inside a query parameter
  3. The script executes successfully in the browser!
  

Problem conclusion

• Hatsruntime.jar code changes have been made to sanitize the
  malicious code to address the Cross-site scripting attack. Refer
  to the blog "Enabling HATS XSS Filter" to enable HATS cross site
  scripting protection.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• RUNTIME
  

Fix information

• Fixed component name

  RATL HATS FOR 5

• Fixed component ID

  5724U6800

Applicable component levels

• R960 PSY

     UP