Skip to main content
C
chrispeco
Known Participant
February 23, 2012
Question

RoboHelp 9 - Enabling the cookie secure flag

  • February 23, 2012
  • 1 reply
  • 708 views

Hello All - Have a question about RoboHelp 9 and a security vulnerability.  We discovered a vulnerability in the webhelp output we produce so I am starting here.  The site requires authentication and then passes it into the page, so we believe that RoboHelp uses frames within its framework. The use of frames in authenticated sites is not recommended and as mentioned is a security vulnerability.

The new version fixes the cross-site scripting vulnerability involving the query string (example.paychex.com/path?XSS) but introduces an equivalent vulnerability with the URL hash tag (example.site.com/path#XSS). Normally, anything after the hash tag is considered a “fragment identifier”, which is a reference to some position in the document. Seems the vulnerability is due to the enabling cookie secure flag.

Has anyone heard of this?

Thanks.
Chris

    This topic has been closed for replies.

    1 reply

    Praful_Jain
    Praful_Jain
    Participating Frequently
    February 24, 2012

    hi Chris,

    Adobe RoboHelp team is looking into issue, and will keep the user forum updated of the progress. In the mean time, can you please provide the following information

    • Webserver configuration where the help output is published
    • Authentication mechanism used by the webserver.
    • Sample URL which contains XSS which on click shows some alert message or other vulnerability.

    Thanks

    Praful Jain

    Adobe RoboHelp Team

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices