Actions
Bug #17012
open
Potential XSS via Suricata IP List filenames
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
The Suricata IP List page at suricata_ip_list_mgmt.php does not encode filenames before display or use in JavaScript.
Uploading an IP List file with a name such as the following can trigger an XSS on the page:
xsstest123<img src=x onerror=alert(String.fromCharCode(88,83,83))>.txt
These files are also printed without encoding on suricata_iprep_list_browser.php when adding a Categories File or IP Reputation List.
Reported by: @lujiefsi
Updated by
Actions
Also available in: Atom