templates_import.php does not filter html metacharacters when importing
xml template files. This may cause a persistent cross-site scripting
when importing templates from untrusted sources.
How to reproduce:
Import a template file with a specially crafted <name>...</name> tag,
such as shown here.
Unix - Load Average<![CDATA[<script>alert(document.cookie)</script>]]>
Fix provided to Nils in package cacti-0.8.7b-1.1.src.rpm
This is not fixed in 0.8.7e which is in current HPC 1.2 (0.8.7e-1.1.el5 is in HPC, testing with 0.8.7e-3.fc12 which would have more fixes for recent issues).
This can be reproduced by going to Export Templates, select a template to export and output to browser within Cacti. Copy this then go to Import Templates and past it in. Then edit the <name></name> section as noted above (I copied the Cisco - CPU Usage template).
When you go back to the Export Template page after importing, you will get a popup that prints:
which is the cookie data. Going to the Export Template page and looking at the exported template, I see:
<name>Cisco - CPU Usage Test<script>alert(document.cookie)</script></name>
So it's being filtered on display/export, but it's being interpreted when the export page is being shown due to:
<select id='export_item_id' name='export_item_id'><option value='18'>Cisco - CPU Usage Test<script>alert(document.cookie)</script></option>
(not escaped when building the select list). Looking at the list of patches upstream, this is not fixed their either.
Created attachment 409911 [details]
patch to fix xss in cacti
This patch fixes the problem for me by throwing htmlspecialchars() around data pulled from the database to create the dropdown menu list.
This problem is not limited to template import. You can inject JS into template name even when creating templates manually. This can only be performed by cacti administrator.
Marc, was this originally reported as template import only issue due to a "cacti admin can be tricked to import untrusted template" vector?
This still affects 0.8.7f-1.
During the discussions with upstream, it was discovered that other items that can be configured in cacti and have name, or description, or similar attribute, can be used as injection vector. In all cases, certain level of administrative privileges is required to change those attributes. Following upstream patches added in 0.8.7g add html escaping before those attributes are printed back to generated web pages:
This issue has been addressed in following products:
Red Hat HPC Solution for RHEL 5
Via RHSA-2010:0635 https://rhn.redhat.com/errata/RHSA-2010-0635.html