Project

General

Profile

Actions
Copy link

Bug #16942

closed
JP JP

Potential XSS via IPsec Phase 1 descriptions while editing Phase 2 entries

Bug #16942: Potential XSS via IPsec Phase 1 descriptions while editing Phase 2 entries

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
IPsec
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

When editing an IPsec Phase 2 entry, the vpn_ipsec_phase2.php page displays the description of the associated IPsec Phase 1 entry without encoding.

Setting an IPsec P1 description to a specially-crafted payload such as <img src=x onerror=alert('xss')> will produce an alert while viewing a P2 entry associated with that P1.

Files

16942.patch (541 Bytes) 16942.patch Jim Pingle, 07/10/2026 05:36 PM
Actions
Copy link

Also available in: Atom