Cross-site scripting (XSS) in Interact
Overview
Interact is a content-rich intranet platform. You can build content such as pages, widgets and workflows using HTML tags. For example, some customers showcase their content in a particular way by hosting third-party sites in pages or widgets using iframes, or by building complex HTML accordions.
Because the intranet can store HTML tags, a user could inject client-side scripts with malicious intent into pages viewed by others. This is known as a persisted XSS (cross-site scripting) attack.
Interact lets administrators enable or disable individual tags for both public and privileged actions.
There are no reflected XSS vulnerabilities in Interact.
Public and privileged actions
Actions in Interact fall into two categories: public actions and privileged actions. The category an action falls into depends broadly on the type of content being affected. Creating content, such as a new page or a blog post, is a privileged action because it requires additional permission to be allocated to the user.
Responding to content, such as commenting on a page or posting on a forum, is a public action, which does not require additional permissions.
For example, creating a new page of content requires Content Author permissions within a content area, so it is a privileged action. Any user can comment on a timeline post without additional privileges, so that is a public action.
This lets organisations build governance policies around these actions and ensure that only trusted users can use the relevant HTML tags.
Tags
HTML tags can be classified individually by risk. Some tags, such as <script>, present more of a direct risk than others, such as <iframe>. Interact lets you configure which individual HTML tags can be used within your content and which should be restricted. In some cases, one tag can be used to inject another tag with greater risk. For example, inline styles can be used to perform XSS attacks without using a script tag.
In some cases, restricting HTML tags prevents features from being used in Interact. If the <iframe> tag is restricted, embedding an iframe inside a Freetext Widget no longer works, so you lose the ability to present third-party websites within your homepage.
When deciding which HTML tags (if any) can be used in Interact, weigh the potential loss of functionality against the risk that HTML tags may present. Discuss this with Interact Technical Support, who can then make the required amendments.
The tags that can be disabled are listed below. Each tag can be disabled for each category of action individually and independently of the other categories. For example, you can disable the script tag for public actions but enable it for privileged actions.
The available tags are <script>, <iframe>, <form>, <object>, <embed>, <link>, <head>, <meta> and <style>.
Configuration
By default, all tags are enabled for both privileged and public actions. To change the configuration of any tags, contact Interact Technical Support, who can make the required changes for you.
Workflow & Forms
The Workflow & Forms application lets administrators build HTML forms to reflect business processes in electronic form. By design, Interact lets administrators add any HTML tag without restriction when building a form.
When a user completes a form, they are prevented from adding HTML tags to their responses.