routing: Fix potential authenticated XSS in input processing

An authenticated Stored XSS (Cross-site Scripting) exists in the
(https://192.168.0.241:444/cgi-bin/routing.cgi) Routing Table Entries
via the "Remark" text box  or "remark" parameter. This is due to a
lack of user input validation in "Remark" text box  or "remark"
parameter. It allows an authenticated WebGUI user with privileges
for the affected page to execute Stored Cross-site Scripting in
the Routing Table Entries (/cgi-bin/routing.cgi), which helps
attacker to redirect the victim to a attacker's phishing page.

The Stored XSS get prompted on the victims page whenever victim
tries to access the Routing Table Entries configuraiton page.

An attacker get access to the victim's session by performing
the CSRF and gather the cookie and session id's or possibly can
change the victims configuration using this Stored XSS.

This attack can possibly spoof the victim's informations.

Fixes: #12072
Reported-by: Dharmesh Baskaran <dharmesh201093@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/core/132/filelists/files b/config/rootfiles/core/132/filelists/files
index f949492fa78e88c841ec27d10c863810bb90df70..67d009f9c07b2d6f12bfdfc56eca6df3e1bb3996 100644 (file)
--- a/config/rootfiles/core/132/filelists/files
+++ b/config/rootfiles/core/132/filelists/files
@@ -9,6 +9,7 @@ srv/web/ipfire/cgi-bin/captive.cgi
 srv/web/ipfire/cgi-bin/credits.cgi
 srv/web/ipfire/cgi-bin/firewall.cgi
 srv/web/ipfire/cgi-bin/proxy.cgi
+srv/web/ipfire/cgi-bin/routing.cgi
 srv/web/ipfire/cgi-bin/zoneconf.cgi
 usr/lib/firewall/rules.pl
 usr/sbin/convert-snort

diff --git a/html/cgi-bin/routing.cgi b/html/cgi-bin/routing.cgi
index f2014e2e12f917ecc31c56c7490534a52a420874..be21007fa837ee4857da4fea0cb93b6d14afafc7 100644 (file)
--- a/html/cgi-bin/routing.cgi
+++ b/html/cgi-bin/routing.cgi
@@ -137,6 +137,9 @@ if ($settings{'ACTION'} eq $Lang::tr{'add'}) {
        $errormessage = $Lang::tr{'invalid ip'}. " - ".$Lang::tr{'gateway ip'};
        }
 
+       # Escape input in REMARK field
+       $settings{'REMARK'} = &Header::escape($settings{'REMARK'});
+
        #set networkip if not already correctly defined
        my($ip,$cidr) = split(/\//,$settings{'IP'});
        my $netip=&General::getnetworkip($ip,$cidr);