Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2010-2545 cacti: XSS via various object names or descriptions|
|Product:||[Other] Security Response||Reporter:||Marc Schoenefeld <mschoene>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED ERRATA||QA Contact:|
|Version:||unspecified||CC:||jturner, kseifried, ocs2, plautrba, security-response-team, vdanen|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2011-09-29 23:30:22 EDT||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||459106|
Description Marc Schoenefeld 2008-08-15 04:28:33 EDT
Description: templates_import.php does not filter html metacharacters when importing xml template files. This may cause a persistent cross-site scripting when importing templates from untrusted sources. How to reproduce: /cacti/templates_import.php: Import a template file with a specially crafted <name>...</name> tag, such as shown here. <cacti> <hash_000016fe5edd777a76d48fc48c11aded5211ef> <name> Unix - Load Average<![CDATA[<script>alert(document.cookie)</script>]]> </name> ...
Comment 2 OCS Support 2008-09-22 13:53:23 EDT
Fix provided to Nils in package cacti-0.8.7b-1.1.src.rpm
Comment 3 Vincent Danen 2010-04-28 13:15:40 EDT
This is not fixed in 0.8.7e which is in current HPC 1.2 (0.8.7e-1.1.el5 is in HPC, testing with 0.8.7e-3.fc12 which would have more fixes for recent issues). This can be reproduced by going to Export Templates, select a template to export and output to browser within Cacti. Copy this then go to Import Templates and past it in. Then edit the <name></name> section as noted above (I copied the Cisco - CPU Usage template). When you go back to the Export Template page after importing, you will get a popup that prints: Cacti=8fbm1iu01ih6su8rabm7fgp8t1 which is the cookie data. Going to the Export Template page and looking at the exported template, I see: <name>Cisco - CPU Usage Test<script>alert(document.cookie)</script></name> So it's being filtered on display/export, but it's being interpreted when the export page is being shown due to: <select id='export_item_id' name='export_item_id'><option value='18'>Cisco - CPU Usage Test<script>alert(document.cookie)</script></option> (not escaped when building the select list). Looking at the list of patches upstream, this is not fixed their either.
Comment 4 Vincent Danen 2010-04-28 13:36:16 EDT
Created attachment 409911 [details] patch to fix xss in cacti This patch fixes the problem for me by throwing htmlspecialchars() around data pulled from the database to create the dropdown menu list.
Comment 8 Tomas Hoger 2010-06-29 05:40:04 EDT
This problem is not limited to template import. You can inject JS into template name even when creating templates manually. This can only be performed by cacti administrator. Marc, was this originally reported as template import only issue due to a "cacti admin can be tricked to import untrusted template" vector? This still affects 0.8.7f-1.
Comment 10 Tomas Hoger 2010-07-12 05:45:55 EDT
During the discussions with upstream, it was discovered that other items that can be configured in cacti and have name, or description, or similar attribute, can be used as injection vector. In all cases, certain level of administrative privileges is required to change those attributes. Following upstream patches added in 0.8.7g add html escaping before those attributes are printed back to generated web pages: http://svn.cacti.net/viewvc?view=rev&revision=6037 http://svn.cacti.net/viewvc?view=rev&revision=6038 http://svn.cacti.net/viewvc?view=rev&revision=6041 http://svn.cacti.net/viewvc?view=rev&revision=6042 http://cacti.net/release_notes_0_8_7g.php