Project

General

Profile

Bug #5351

Sanitze user input, even if restricted by html

Added by Marcel Hellwig over 3 years ago. Updated over 3 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Web Interface
Target version:
Start date:
10/28/2015
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.3
Affected Architecture:
All

Description

The following XSS can be eleminated, by checking if the input is a number, but I think there are more attacks possible.

Go to the dashboard and open the trafficgraph-settings. Change the input type from number to text for the refresh-interval element and put some xss content inside, e.g.

"><script>alert("XSS")</script>

and voila, there you have it.
I think there are tons of XSS-attacks possible. The problem is, that these settings are shared via user accounts, so a "unprivileged" user can change those settings and attack an admin for example.

Associated revisions

Revision dc6927bc (diff)
Added by Chris Buechler over 3 years ago

Add output validation here too. Ticket #5351

History

#1 Updated by Jim Thompson over 3 years ago

  • Assignee set to Steve Beaver

#2 Updated by Steve Beaver over 3 years ago

  • Status changed from New to Feedback

Added input validation to this and other widgets that showed the same vulnerability.

#3 Updated by Steve Beaver over 3 years ago

  • % Done changed from 0 to 100

#4 Updated by Chris Buechler over 3 years ago

  • Status changed from Feedback to Resolved

that instance and others in widgets resolved now

Also available in: Atom PDF