vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-01 00:19:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

[Security] Fixes possible XSS in login.lua referer param

Browse source 
Fixes

XSS1 | Reflected

URL
http://192.168.2.200:3000/lua/login.lua?referer=%27%3E%3Cscript%3Ealert(1)%3C/script%3E

METHOD
Get

PARAMETER
referer

PAYLOAD
'><script>alert(1)</script>
This commit is contained in:
Simone Mainardi 2019-03-14 11:35:35 +01:00
parent 37b8a80498
commit 5a67bf6e43
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/lua/modules/http_lint.lua
View file

@ -1552,7 +1552,12 @@ function http_lint.validationError(t, param, value, message)
-- TODO graceful exit
local s_id
if t == _GET then s_id = "_GET" else s_id = "_POST" end
error("[LINT] " .. s_id .. "[\"" .. param .. "\"] = \"" .. (value or 'nil') .. "\" parameter error: " .. message)
-- Must use urlencode to print these values or an attacker could perform XSS.
-- Indeed, the web page returned by mongoose will show the error below and
-- one could place something like '><script>alert(1)</script> in the value
-- to close the html and execute a script
error("[LINT] " .. s_id .. "[\"" .. urlencode(param) .. "\"] = \"" .. urlencode(value or 'nil') .. "\" parameter error: " .. message.."")
end
-- #################################################################