Red Hat Bugzilla – Bug 546329
systems/details/history/event.pxt would not quote HTML tags in event results field properly
Last modified: 2014-07-04 09:29:20 EDT
Description of problem:
In case a registered client would return part of HTML text in the action
result to the server, Systems / Events / History page won't be able to quote
HTML tags in the event result details field properly (as in the browser would
process this text as if it would be part of the page).
We should be more careful about the data that flows from client to
server and not to trust it blindly.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Create a following HTML file on your system registered to Satellite:
<form name="CSRF" method="GET"
2. Schedule an action on your client from Satellite webui (run a remote
3. Make your client return this as a part of the action response:
</td></tr></table><iframe src="http://your.client.machine/your-page.html"><p><b>logged out</b></p></iframe>
4. Run the action from your client (rhn_check)
5. Visit the action result page
You will be logged out of your Satellite
Results will be rendered as an ordinary text (HTML tags will be quoted).
You can think of a more malicious scenarios (other than logging the user out).