XSS attempts were output to the ntopng logs for example as:
14/Mar/2019 12:53:07 [LuaEngine.cpp:9164] WARNING: Script failure [/home/simone/ntopng/scripts/lua/about.lua][/home/simone/ntopng/scripts/lua/modules/http_lint.lua:1555: [LINT] _POST["ntopng_license"] = "'><script>alert(2)</script>" parameter error: Validation error]
When page runtime.lua was reading logs to show them, the JS was interpreted and scripts were executed.
Fixes
XSS3 | Stored
URL
http://192.168.2.200:3000/lua/runtime.lua
METHOD
Get
* partial work
* Migrate 'mode' parameters
* Migrate alerts types
* Fix some interface ids
* Partial work
* Partial work
* End of work for _GET parameters
* Work in progress
* Add support for special parameters
* Preferences validation
* Fixes and improvements
* Enforce interger validation
