Bug 1428948 (CVE-2017-2661)

Summary: CVE-2017-2661 pcs: Improper node name field validation when creating clusters leads to XSS
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anprice, cbuissar, cfeist, cluster-maint, idevat, jpokorny, mgrac, omular, security-response-team, sfowler, sisharma, smohan, sparks, ssaha, tojeline, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: pcs 0.9.157 Doc Type: If docs needed, set a value
Doc Text:
It was found that pcsd was vulnerable to reflected cross-site scripting (XSS) attacks while handling node names during creation or import of a cluster. An attacker could use this flaw to run javascript code in an authenticated session.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-23 17:11:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1434111    
Bug Blocks: 1428949    
Attachments:
Description Flags
proposed fix none

Description Adam Mariš 2017-03-03 16:41:16 UTC 
Cross-site scripting vulnerability was found in pcs due to improper validation of Node name field when creating new cluster or adding existing cluster.

Upstream fix :
*  web UI: fixed XSS vulnerability 
https://github.com/ClusterLabs/pcs/commit/1874a769b5720ae5430f10c6cedd234430bc703f
Comment 1 Adam Mariš 2017-03-03 16:41:23 UTC 
Acknowledgments:

Name: Microsoft
Comment 11 Cedric Buissart 2017-03-20 18:09:18 UTC 
Created pcs tracking bugs for this issue:

Affects: fedora-all [bug 1434111]
Comment 13 Tomas Jelinek 2017-03-21 13:30:29 UTC 
Created attachment 1265070 [details]
proposed fix