Actions
Bug #16996
open
apcupsd: Potential XSS and ACE due to insufficient validation on nisip option
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
The apcupsd package attempts to validate the value of nisip ("NIS IP Address") on apcupsd.xml when saving, but it does not properly anchor a pattern match, allowing potentially malicious payloads that include values from the improper pattern match.
When viewing the UPS status on apcupsd_status.php, the content of nisip is used in a shell command without escaping, leading to a potential authenticated command execution path. The value is also printed to the user without encoding, leading to a potential XSS.
Reported by: @lujiefsi
Updated by
Actions