full-disclosure - Re: [FD] ntopng 1.2.0 XSS injection using monitored network traffic

Open Source and information security mailing list archives

Date: Mon, 08 Sep 2014 09:46:58 -0700
From: Luca Carettoni <luca.carettoni@...isoft.com>
To: fulldisclosure@...lists.org
Subject: Re: [FD] ntopng 1.2.0 XSS injection using monitored network traffic

This issue has been fixed in ntopng 1.2.1, together with other security
bugs http://www.ntop.org/ndpi/released-ndpi-1-5-1-and-ntopng-1-2-1/

@Steffen
I am sure that the ntopng maintainer would appreciate an early heads-up
next time.

On Wed, 2014-09-03 at 09:32 +0200, Steffen Bauch wrote:
> On 25.08.2014 21:48, Steffen Bauch wrote:
> > ntopng 1.2.0 XSS injection using monitored network traffic
> >
> > ntopng is the next generation version of the original ntop, a network
> > traffic probe and monitor that shows the network usage, similar to what
> > the popular top Unix command does.
> >
> > The web-based frontend of the software is vulnerable to injection of
> > script code via forged HTTP Host: request header lines in monitored
> > network traffic.
> >
> > HTTP Host request header lines are extracted using nDPI traffic
> > classification library and used without sanitization in several places
> > in the frontend, e.g. the Host overview and specific subpages for each
> > monitored host.
> >
> > The injected code might be used to execute javascript and to perform
> > management actions with the user-rights of the current ntopng user,
> > which can be used to disable the monitoring function or deletion of
> > accounts making the monitoring system unusable.
> >
> > To give a coarse idea of the vulnerability the following python script
> > can be used on the monitored network, afterwards the victim needs to
> > browse to the Host overview / Host details in the ntopng frontend.
> >
> > import httplib
> >
> > conn = httplib.HTTPConnection("example.com")
> > headers = {"Host": "<SCRIPT>alert(\"xss\")</SCRIPT>", "Accept":
> > "text/plain"}
> > conn.request("GET", "/", None, headers)
> > r1 = conn.getresponse()
> > print(r1.status, r1.reason)
> > data1 = r1.read()
> >
> > Other users of the nDPI code might be affected as well.
> >
> > Steffen Bauch
> > Twitter: @steffenbauch
> > http://steffenbauch.de
> 
> MITRE has assigned CVE-2014-5464 for this issue.

Download attachment "signature.asc" of type "application/pgp-signature" (967 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives