Project

General

Profile

Actions
Copy link

Bug #16942

closed
JP JP

Potential XSS via IPsec Phase 1 descriptions while editing Phase 2 entries

Bug #16942: Potential XSS via IPsec Phase 1 descriptions while editing Phase 2 entries

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
IPsec
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

When editing an IPsec Phase 2 entry, the vpn_ipsec_phase2.php page displays the description of the associated IPsec Phase 1 entry without encoding.

Setting an IPsec P1 description to a specially-crafted payload such as <img src=x onerror=alert('xss')> will produce an alert while viewing a P2 entry associated with that P1.

Files

16942.patch (541 Bytes) 16942.patch Jim Pingle, 07/10/2026 05:36 PM

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #1

  • Private changed from No to Yes

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #3

Fixed in commit a8c94d9330b0d814ae87e176e74fa5d3ef53eb58

Added encoding to the output.

Patch is attached.

GT Updated by Georgiy Tyutyunnik about 2 months ago Actions
Copy link
 #4

  • Status changed from Feedback to Resolved

fixed in the latest dev
tested on:
26.07-BETA (amd64)
built on Fri Jul 17 15:34:00 UTC 2026
FreeBSD 16.0-CURRENT

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #5

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom