Actions
Bug #16945
closed
JP
JP
Potential XSS via URL Table Ports Alias content
Bug #16945:
Potential XSS via URL Table Ports Alias content
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
Comments imported with URL Table Aliases for Port content are retained and printed back to the user when an alias is used in a firewall rule (firewall_rules.php) or NAT rule (firewall_nat.php) as they both use the same helper function alias_info_popup() which prints that content without encoding.
To reproduce, first create a URL Table (Ports) type alias with a URL pointing to a location with a specially-crafted payload like the following:
#" onmouseover=alert(/XSS/.source) x=" 80
Then use the resulting port alias in a firewall rule and/or a NAT rule. Then hover the mouse over the alias name in the rule list.
Files
Actions