Bug 459229 (CVE-2010-2545)
| Summary: | CVE-2010-2545 cacti: XSS via various object names or descriptions | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marc Schoenefeld <mschoene> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | unspecified | CC: | jturner, kseifried, ocs2, plautrba, security-response-team, vdanen | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-09-30 03:30:22 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 459106 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
Fix provided to Nils in package cacti-0.8.7b-1.1.src.rpm This is not fixed in 0.8.7e which is in current HPC 1.2 (0.8.7e-1.1.el5 is in HPC, testing with 0.8.7e-3.fc12 which would have more fixes for recent issues). This can be reproduced by going to Export Templates, select a template to export and output to browser within Cacti. Copy this then go to Import Templates and past it in. Then edit the <name></name> section as noted above (I copied the Cisco - CPU Usage template). When you go back to the Export Template page after importing, you will get a popup that prints: Cacti=8fbm1iu01ih6su8rabm7fgp8t1 which is the cookie data. Going to the Export Template page and looking at the exported template, I see: <name>Cisco - CPU Usage Test<script>alert(document.cookie)</script></name> So it's being filtered on display/export, but it's being interpreted when the export page is being shown due to: <select id='export_item_id' name='export_item_id'><option value='18'>Cisco - CPU Usage Test<script>alert(document.cookie)</script></option> (not escaped when building the select list). Looking at the list of patches upstream, this is not fixed their either. Created attachment 409911 [details]
patch to fix xss in cacti
This patch fixes the problem for me by throwing htmlspecialchars() around data pulled from the database to create the dropdown menu list.
This problem is not limited to template import. You can inject JS into template name even when creating templates manually. This can only be performed by cacti administrator. Marc, was this originally reported as template import only issue due to a "cacti admin can be tricked to import untrusted template" vector? This still affects 0.8.7f-1. During the discussions with upstream, it was discovered that other items that can be configured in cacti and have name, or description, or similar attribute, can be used as injection vector. In all cases, certain level of administrative privileges is required to change those attributes. Following upstream patches added in 0.8.7g add html escaping before those attributes are printed back to generated web pages: http://svn.cacti.net/viewvc?view=rev&revision=6037 http://svn.cacti.net/viewvc?view=rev&revision=6038 http://svn.cacti.net/viewvc?view=rev&revision=6041 http://svn.cacti.net/viewvc?view=rev&revision=6042 http://cacti.net/release_notes_0_8_7g.php This issue has been addressed in following products: Red Hat HPC Solution for RHEL 5 Via RHSA-2010:0635 https://rhn.redhat.com/errata/RHSA-2010-0635.html |
Description: templates_import.php does not filter html metacharacters when importing xml template files. This may cause a persistent cross-site scripting when importing templates from untrusted sources. How to reproduce: /cacti/templates_import.php: Import a template file with a specially crafted <name>...</name> tag, such as shown here. <cacti> <hash_000016fe5edd777a76d48fc48c11aded5211ef> <name> Unix - Load Average<![CDATA[<script>alert(document.cookie)</script>]]> </name> ...