Bug #16976
Updated by Jim Pingle about 2 months ago
The page at @status_graphs.php@ displays a table of hosts consuming bandwidth in real-time. Optionally, this table can resolve IP addresses to fully qualified domain names or use descriptions from DHCP static mappings or DNS host overrides for display. The values returned by the these lookups address lookup are not validated and are displayed without encoding. These address lookups It may be possible for a PTR record or hosts entry to return an XSS payload, which could result in XSS depending on payload instead of a proper hostname. If the settings on the traffic graphs page. There are multiple paths which can potentially trigger the problem, but not all of them are viable: * When *Display* page is set configured to _FQDN_: * Payload in a hostname directly in @/etc/hosts@ -- Would have to be manually edited in, no way to set that in the GUI as it doesn't pass validation * Payload in a PTR record from DNS -- FreeBSD libraries filter out such invalid display hostnames so they don't make for observed addresses, it to the client * When *Display* is set to _Description_: * Payload could result in DNS Resolver or DNS Forwarder Host Override descriptions -- Can be set by user and triggers the problem * Payload in DHCP Static Mapping descriptions -- Could work, but the functionality is broken, see #16979 XSS.