New BUG: Quotation Marks in display names can break 3CX Windows App Registering.

[BrenttG]

Ran into this issue today and was able to test and reproduce it as well. Seems the 3CX Windows app does not properly parse quotation marks in the display names of users when they are present in the provisioning file that is delivered by email.

This may also affect the android and iphone apps as well but i have not tested this.

Steps to reproduce:
In the first name field of an extention type a name with Quotes such as our example:
William "Willy"

In the last name field:
Johnson

Fill all other fields out normally.

Extention works fine with deskphones, etc, but the Windows App will attempt to register, and then fail endlessly, sometimes even getting stuck running in the background when exitted.

While testing, i compared a working provisioning file, and the one for this extention, and notices the quotation marks were the only substantive difference, so i editted the file with notepad, and removed the quotation marks from the name manually, saved, and then dropped the same file onto the App, and bang, it works now. I then updated the extentions to remove a few instances where the client had added them like above for peoples nicknames.

This should get fixed, even tho it is a minor issue, otherwise, just block use of quotes in those fields so it does not happen to anyone else, because the malfunctions of the app dont clearly point to any cause.

 

[NickD_3CX]

Hi @DocTechAZ
We managed to replicate this and have notified our R&D team to look into this.

Thank you for reporting it!

 

[BrenttG]

Your Welcome, something tells me this might point out that there could be an XSS or Injection vulnerability in there also if the handling of Quotes is not being properly encoded or sterilized, i would strongly suspect that, so they should investigate that possibility too, from a security standpoint. I know the app utilized https for some of its data from the server.

 

[NickD_3CX]

Your Welcome, something tells me this might point out that there could be an XSS or Injection vulnerability in there also if the handling of Quotes is not being properly encoded or sterilized, i would strongly suspect that, so they should investigate that possibility too, from a security standpoint. I know the app utilized https for some of its data from the server.

You are absolutely right. Our R&D was actually looking into this even before you reported this specific case for the exact reason you laid out, so basically our report became an extra bullet in the already existing internal case. From our so far information, there is no security issue that could be caused by this, but it did cause the the SIP messages to become "broken".