Actions
Bug #16947
closed
JP
JP
Potential Local File Include vulnerability via Dashboard widget sequence data
Bug #16947:
Potential Local File Include vulnerability via Dashboard widget sequence data
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The Dashboard widget layout data (sequence) is not validated when making changes to widgets or when displaying widget data.
If a user can write an arbitrary file on the firewall (e.g. /tmp/test.widget.php), they could store a widget sequence value including a widget name that traverses the path to that file (e.g. ../../../../../../../../../../../tmp/test)
The Dashboard will read that PHP file and execute it as if it were a Dashboard widget.
Files
Actions