Cross side scripting in Flex

Question

Hello,
We are using flex 3.0 in our project with java1.5 and during our security testing (by a tool) we found that the Cross side scripting
can be acheived in flex. We are able to inject java scripts inside parameter AMF.Message.0.null.flex.messaging.messages.CommandMessage.8.clientId , thanks to let us know how can we solve this
issue and make our flex application out of this security issue.
The following changes were applied to the original request:
Injected '<script>alert(56180)</script>' into parameter 'AMF.Message.0.null.flex.messaging.messages.CommandMessage.8.clientId's value
Set cookie 'JSESSIONID's value to '6A0BA588B3E2663A842C9A495CFC69F9'
Set cookie 'MODCASID's value to 'XfUjTlYJ4atZwnmN2ziB88V1yYuvggHb9CKOIAFHy088F6ByRcAfLUfA8ZTAO0K89g7WHLhl9cgZHYN9wloSWunlhn mOKaWxBb0e1B6InG3tIKoUwXRhBUESdfGxGP3WIzGiPAmub0J8sTqgGH0LecYjTVJIGiVYaD13cENpMJngYk5n8UBG Y5dJpFfBYMO...(33 characters more)'
Set cookie 'WT_ST_FPC=id's value to '243135f022bc4984bcc1346284111474:lv=1346284111474:ss=1346284111474'
Set HTTP header to '6A0BA588B3E2663A842C9A495CFC69F9; MODCASID=XfUjTlYJ4atZwnmN2ziB88V1yYuvggHb9CKOIAFHy088F6ByRcAfLUfA8ZTAO0K89g7WHLhl9cgZHYN9 wloSWunlhnmOKaWxBb0e1B6InG3tIKoUwXRhBUESdfGxGP3WIzGiPAmub0J...(31 characters more)'
New request and response
POST /esample/messagebroker/amfsecure?a=1 HTTP/1.1
Cookie: WT_ST_FPC=id=2cc27004653f1b51cbf1346285874746:lv=1346285874746:ss=1346285874746; MODCASID=MHAPkwaeif8fDqMKnnrjFad8J0rQYAVYUBiufXADkB4w0Zb1HAAF0LYAz3m7WD8cEWJ4E5An3FFDdoqV U58jYuOvh2W5HvIiGzDOAmtb7gLYUzcZbaFayFUX8qvHQB0068bVohDPBnHzFbR2LXpT9B0tdDYbCq30uDPuBc00pO 5Z92cJTaQFeigxOnj2D2PB5OqqrwHeHC5bq0glVBvUvMIYUiM5ipJAkPiQ0lblZlP809ln84NjSUHNP2McbFgC3Dsy 0RDmsc9AUuCBAiyBWJBLmzM08rDNNqm25a9BDsB3u81UheSJbZBCuHSmfyTCIykCnFErjFnJ5EqinmLyEjbVl3b04v ToKs9Xqf0kjr4ESYPIBkLpdWaCjUEAuD98EcfeLPYW8aZVBXx; JSESSIONID=8BEE6BEA5DD8D17D663DEFB2B3C56D0E
Content-Length: 307
Accept: */*
Accept-Language: en-US
Referer: https://XXX/YYY/html/swf/bin/abc.swf
x-flash-version: 11,1,102,55
Content-Type: application/x-amf
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; MS-RTC LM 8)
Host: qa-my.st.com
Connection: Keep-Alive
Cache-Control: no-cache
_   _ _null _/1  __
?_Mflex.messaging.messages.CommandMessage_operation_correlationId_timeToLive_destination_m essageId_headers                body_timestamp_clientId_____ ___I415752AC-037C-B994-6A8B-70D83D552A6C
__%DSMessagingVersion__               DSId_I3C7FD548-C11C-23D5-4A69-5DD471350E15_
___ _;<script>alert(56180)</script>
HTTP/1.1 200 OK
Content-Length: 186
Connection: Keep-Alive
Date: Thu, 30 Aug 2012 05:48:06 GMT
Server: Apache-Coyote/1.1
X-Powered-By: Servlet 2.4; JBoss-4.2.3.GA (build: SVNTag=JBoss_4_2_3_GA date=200807181417)/JBossWeb-2.0
Content-Type: application/x-amf
_   _ _/1/onResult  ????_
__DSK?__;<script>alert(56180)</script>
#_            DSId%DSMessagingVersion_I3C7FD548-C11C-23D5-4A69-5DD471350E15_??      _Bs?a'?  _!IC ??_J!??.D?4??__!AWR?_|??j?p?=U*l
Thanks,
Amit

Answer 1

Hi,
Please refer to the article:
http://blogs.msdn.com/b/how24/archive/2013/05/28/cross-site-scripting-sharepoint-apps-app-parts-and-office-365.aspx
“Since the release of SharePoint 2013 adding OData support, expanding the RESTful services and empowering the CSOM (Client side object model). Also with the addition of the Content by search web part. There are times where you will need to
execute cross site queries or queries across multiple domains. For that Microsoft has introduced the ‘Cross-domain library (SP.RequestExecutor.js)’.”
Please also check the thread below:
http://social.technet.microsoft.com/Forums/en-US/29e47d18-30f6-4f15-b054-4a03f7ba5156/microsoft-windows-mhtml-crosssite-scripting-and-sharepoint-2013?forum=sharepointgeneral 
QUOTE: “SharePoint 2013 is different from its predecessor because its already have the XSS prevention method built-in. but it is not closed the probability that the threat is gone for good, so please to keep your SharePoint environment updated by the
latest cumulative update.”
Regards,
Rebecca Tu
TechNet Community Support