Actions
Bug #16973
open
Potential XSS in FRR Status
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
The FRR status page, status_frr.php, does not handle the encoding of FRR status output properly when it is passed through AJAX/JavaScript. It unnecessarily encodes and then decodes the content and then places plain text in containers using methods meant for HTML. Much of the encoding could be removed and replaced with text methods instead.
Cases where this might be a concern are very rare, such as a malicious BGP Peer sending a hostname containing an XSS payload.
Reported by: @lujiefsi
Updated by Jim Pingle about 14 hours ago
- Status changed from Confirmed to Feedback
- % Done changed from 0 to 100
- Private changed from Yes to No
Fixed in commit 169f6a566570b2db71385216d4dc86405451c21e
Updated packages are available for Plus 26.03.1 (v2.1.2_2) and CE 2.8.1 (v2.0.2_7)
Actions