Actions
Bug #16920
open
Potential stored XSS in ``status_monitoring.php`` via saved views
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
When saving views on status_monitoring.php none of the fields have validation, and some can be printed back to the user without encoding in certain circumstances, leading to a potential stored XSS.
Furthermore there is a lot of room for improvement/cleanup in the code around these options, and in general. At a minimum it needs validation and to check/correct the encoding when outputting category.
Files
Updated by Jim Pingle about 2 months ago
- File poc-xss-graphs.py poc-xss-graphs.py added
- Status changed from Confirmed to In Progress
- % Done changed from 0 to 90
MR: https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/468
Still needs more testing, but works so far.
POC attached.
Updated by Jim Pingle about 2 months ago
- Status changed from In Progress to Feedback
- % Done changed from 90 to 100
Fixed in commit 42c491e862ca2aa6edefe124cf7585791a338448
Picked back to 2.8.1, 26.03.1
Actions
Also available in: Atom