Bug #17012
Updated by Jim Pingle 2 days ago
The Suricata IP List page at @suricata_ip_list_mgmt.php@ does not encode filenames before display or use in JavaScript. Uploading an IP List file with a name such as the following can trigger an XSS on the page: @xsstest123<img src=x onerror=alert(String.fromCharCode(88,83,83))>.txt@ These files are also printed without encoding on @suricata_iprep_list_browser.php@ when adding a Categories File or IP Reputation List.