An authenticated Stored XSS (Cross-site Scripting) exists in the
(https://192.168.0.241:444/cgi-bin/routing.cgi) Routing Table Entries
via the "Remark" text box or "remark" parameter. This is due to a
lack of user input validation in "Remark" text box or "remark"
parameter. It allows an authenticated WebGUI user with privileges
for the affected page to execute Stored Cross-site Scripting in
the Routing Table Entries (/cgi-bin/routing.cgi), which helps
attacker to redirect the victim to a attacker's phishing page.
The Stored XSS get prompted on the victims page whenever victim
tries to access the Routing Table Entries configuraiton page.
An attacker get access to the victim's session by performing
the CSRF and gather the cookie and session id's or possibly can
change the victims configuration using this Stored XSS.
This attack can possibly spoof the victim's informations.
Fixes: #12072
Reported-by: Dharmesh Baskaran <dharmesh201093@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
srv/web/ipfire/cgi-bin/credits.cgi
srv/web/ipfire/cgi-bin/firewall.cgi
srv/web/ipfire/cgi-bin/proxy.cgi
srv/web/ipfire/cgi-bin/credits.cgi
srv/web/ipfire/cgi-bin/firewall.cgi
srv/web/ipfire/cgi-bin/proxy.cgi
+srv/web/ipfire/cgi-bin/routing.cgi
srv/web/ipfire/cgi-bin/zoneconf.cgi
usr/lib/firewall/rules.pl
usr/sbin/convert-snort
srv/web/ipfire/cgi-bin/zoneconf.cgi
usr/lib/firewall/rules.pl
usr/sbin/convert-snort
$errormessage = $Lang::tr{'invalid ip'}. " - ".$Lang::tr{'gateway ip'};
}
$errormessage = $Lang::tr{'invalid ip'}. " - ".$Lang::tr{'gateway ip'};
}
+ # Escape input in REMARK field
+ $settings{'REMARK'} = &Header::escape($settings{'REMARK'});
+
#set networkip if not already correctly defined
my($ip,$cidr) = split(/\//,$settings{'IP'});
my $netip=&General::getnetworkip($ip,$cidr);
#set networkip if not already correctly defined
my($ip,$cidr) = split(/\//,$settings{'IP'});
my $netip=&General::getnetworkip($ip,$cidr);