Project

General

Profile

Actions
Copy link

Bug #16944

closed
JP JP

Potential XSS in Dynamic DNS widget display of Custom and RFC2136 entries

Bug #16944: Potential XSS in Dynamic DNS widget display of Custom and RFC2136 entries

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Dashboard
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

The Dynamic DNS Dashboard widget prints the host field of Custom entries and the server field of RFC2136 entries without encoding.

Custom entries do not display a host form field, but if the user submits one, it still gets stored and used.

For Custom entries, the payload for host would look like:

<img src=x onerror=alert('XSS')>

For RFC2126 entries, the payload for server would look like:

\"><img src=x onerror=alert('XSS')>

Files

16944.patch (1.2 KB) 16944.patch Jim Pingle, 07/10/2026 06:53 PM

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #2

Fixed in commit c4e46e94f756655f30ea92af8410f74e74b4e2f1

Added encoding to the output.

Patch is attached.

GT Updated by Georgiy Tyutyunnik about 2 months ago Actions
Copy link
 #3

  • Status changed from Feedback to Resolved

fixed in the latest dev
tested on:
26.07-BETA (amd64)
built on Fri Jul 17 15:34:00 UTC 2026
FreeBSD 16.0-CURRENT

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #4

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom