vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-08-23 15:23:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
ntopng/scripts/lua
History
Simone Mainardi ee06ec5b0d [Security] Fixes possible stored XSS in runtime.lua 
XSS attempts were output to the ntopng logs for example as:

14/Mar/2019 12:53:07 [LuaEngine.cpp:9164] WARNING: Script failure [/home/simone/ntopng/scripts/lua/about.lua][/home/simone/ntopng/scripts/lua/modules/http_lint.lua:1555: [LINT] _POST["ntopng_license"] = "'><script>alert(2)</script>" parameter error: Validation error]

When page runtime.lua was reading logs to show them, the JS was interpreted and scripts were executed.

Fixes

XSS3 | Stored

URL
http://192.168.2.200:3000/lua/runtime.lua

METHOD
Get
2019-03-14 13:05:04 +01:00
..
admin Remove user language selector in user add dialog in nEdge 2019-01-02 16:32:33 +01:00
examples Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
inc Fix missing interface selection in footer 2019-01-11 15:08:08 +01:00
modules [Security] Fixes possible XSS in login.lua referer param 2019-03-14 11:40:03 +01:00
about.lua Added nIndex version 2018-12-19 19:38:59 +01:00
API.lua Reworks alerts to prevent local hosts I/O 2017-11-01 23:04:33 +01:00
as_details.lua Add missing active_page 2018-12-12 10:18:21 +01:00
as_stats.lua Page titles 2018-11-29 12:37:01 +01:00
assistant_test.lua Use cross platform ntop.msleep 2018-12-18 18:53:19 +01:00
authorize_captive.lua Implements informative captive portal (no login) 2018-06-06 10:33:36 +02:00
captive_portal.lua Using header-minimal from page_utils, removed header-minimal.inc 2018-11-29 17:25:32 +01:00
change_password.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
check_recording_data.lua Improve traffic extraction dialog 2018-11-14 17:47:32 +01:00
check_update.lua Checks ntopng version updates daily over HTTPs 2018-11-19 18:10:15 +01:00
country_details.lua Add missing active_page 2018-12-12 10:18:21 +01:00
country_stats.lua Page titles 2018-11-29 12:37:01 +01:00
discover.lua Implement sort by IP in network discovery page 2018-12-03 23:22:58 +01:00
do_export_data.lua Tracking more user activities: alerts deleted, all/inactive/interface data deleted, host data deleted, all/host data exproted 2018-12-05 04:36:30 +01:00
export_data.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
find_app.lua Improve category editor labels and protocol navigation 2018-10-18 19:22:02 +02:00
find_category.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
find_host.lua Improves SNMP mac addresses search 2018-10-02 15:33:15 +02:00
find_member.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
find_prefs.lua Fix preferences search error 2018-12-13 10:46:55 +01:00
flow_details.lua Fixes flow_details.lua:18: module 'nf_config' not found 2018-12-13 10:56:21 +01:00
flow_stats.lua Fix crash while mixing hosts with no MAC with hosts with MAC (e.g. with eBPF) 2018-10-18 15:41:37 +02:00
flows_stats.lua New page_utils module for printing header (it will be also used for menu, footer, etc) 2018-11-29 11:48:21 +01:00
get_alerts_data.lua Improve alert time format 2018-12-20 10:32:05 +01:00
get_arp_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_as_data.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
get_ases_data.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
get_config.lua Security fixes in backup/restore paths 2018-08-13 15:38:18 +02:00
get_db_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_db_flows.lua Fix Data Explorer time 2018-12-07 11:45:31 +01:00
get_discover_data.lua Implement sort by IP in network discovery page 2018-12-03 23:22:58 +01:00
get_discover_progress.lua Implements AJAX discovery progress updates 2018-08-02 15:38:11 +02:00
get_extracted_traffic.lua dialog to download multiple files 2018-10-18 15:37:19 +02:00
get_flow_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_flow_db_data.lua Initial flows dbms api skeleton 2018-07-18 17:24:25 +02:00
get_flow_process_tree.lua Updates flow processes graph 2018-11-06 21:13:20 +01:00
get_flows_data.lua Implements eBPF processes drilldown with flows and pie charts 2018-11-06 12:14:20 +01:00
get_geo_hosts.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_grouped_hosts_data.lua Fix country page stats refresh 2018-08-09 11:31:00 +02:00
get_historical_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_historical_favourites.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_host_contacts.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_host_data.lua Added new prefs entry for nIndex 2018-08-07 12:01:09 +02:00
get_host_pools.lua Fix manage pools page js errors with non english locales 2018-09-25 17:34:36 +02:00
get_host_traffic.lua
get_hosts_data.lua builtin packet dump code cleanup (moving to continuous recording) 2018-10-25 09:56:52 +02:00
get_http_hosts.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
get_http_hosts_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_icmp_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_influxdb_info.lua Add InfluxDB information in runtime status and about page 2018-09-12 18:05:20 +02:00
get_mac_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_macs_data.lua Improved passive MDNS discovery 2018-04-02 11:31:28 +02:00
get_num_alerts.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_process_data.lua Refactors eBPF code with ebpf_utils.lua module 2018-11-06 21:57:34 +01:00
get_process_info.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
get_processes_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_processes_graph_data.lua Adds process-process eBPF graphs in host details 2018-11-08 10:14:46 +01:00
get_system_hosts_interaction.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_top_realtime.lua Add missing links to the top ASN and flow talkers 2018-07-10 10:29:43 +02:00
get_top_talkers.lua Fix empty top talkers table 2018-12-20 15:52:42 +01:00
get_treemap.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
get_ts.lua Fix floating point number leading to empty data 2018-12-10 19:23:46 +01:00
get_unknown_devices_data.lua Remove host macs and show source macs instead 2018-03-23 14:42:21 +01:00
get_user_info.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
get_username_data.lua Refactors eBPF code with ebpf_utils.lua module 2018-11-06 21:57:34 +01:00
get_vlan_data.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
get_vlans_data.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
google_assistant_utils.lua Add files via upload 2018-10-10 20:49:44 +02:00
host_details.lua Fix missing host name during first resolution 2019-01-31 13:34:09 +01:00
host_details_ndpi.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
host_details_ndpi_categories.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
host_dns_breakdown.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
host_get_json.lua Added tracker.log(), tracking host_get_json 2018-12-05 01:56:15 +01:00
host_http_breakdown.lua
host_l4_stats.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
host_pkt_distro.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
host_sflow_distro.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
host_stats.lua Fix missing host name during first resolution 2019-01-31 13:34:09 +01:00
host_top_peers_protocols.lua
hosts_comparison.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
hosts_comparison_sankey.lua
hosts_geomap.lua Page titles 2018-11-29 12:37:01 +01:00
hosts_matrix.lua Page titles 2018-11-29 12:37:01 +01:00
hosts_stats.lua Community fixes 2018-12-17 13:02:11 +01:00
hosts_treemap.lua Page titles 2018-11-29 12:37:01 +01:00
hotspot-detect.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
http_servers_stats.lua Page titles 2018-11-29 12:37:01 +01:00
if_pkt_distro.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
if_stats.lua Minor host/interface/network reports fix 2018-12-24 15:09:07 +01:00
if_stats_ndpi.lua Cache if_stats_ndpi timeseries query results 2018-09-19 17:54:28 +02:00
if_stats_ndpi_categories.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
if_tcpflags_pkt_distro.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
iface_flows_sankey.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
iface_hosts_list.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
iface_local_stats.lua Prevents large MySQL exports that could cause Lua OOMs 2018-08-10 15:50:28 +02:00
iface_ndpi_stats.lua Implements eBPF username page with per-user nDPI pie charts 2018-11-05 19:01:05 +01:00
iface_ports_list.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
iface_tcp_stats.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
index.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
info_portal.lua Using header-minimal from page_utils, removed header-minimal.inc 2018-11-29 17:25:32 +01:00
jsontest.lua Example JSON test/decode 2018-05-23 17:15:35 +02:00
live_capture_data.lua Implemented multiple-pcap file download and monitor 2018-08-08 14:06:25 +02:00
live_capture_stats.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
live_traffic.lua Factorization of live traffic download code 2018-08-10 19:14:39 +02:00
live_traffic_extraction.lua added extraction limit (optional) 2018-11-16 10:05:59 +01:00
local_hosts_stats.lua Page titles 2018-11-29 12:37:01 +01:00
login.lua Disable user login after failed attempts 2018-12-17 17:36:38 +01:00
logout.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
mac_details.lua Add missing active_page 2018-12-12 10:18:21 +01:00
mac_pkt_distro.lua ARP fixes 2018-03-22 23:31:24 +01:00
mac_stats.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
macs_stats.lua Page titles 2018-11-29 12:37:01 +01:00
manage_data.lua Temporary hide delete data tab for oem 2018-12-20 16:26:05 +01:00
metrics.lua New pro charts features and timeseries api (#1865) 2018-07-18 15:09:19 +02:00
network_details.lua Minor host/interface/network reports fix 2018-12-24 15:09:07 +01:00
network_load.lua Remove unused field requiring flows walk in network_load 2018-12-18 15:42:04 +01:00
network_state.lua Merge pull request #2093 from FrancescoStaccini/dev 2018-10-11 13:48:00 +03:00
network_stats.lua Page titles 2018-11-29 12:37:01 +01:00
os_stats.lua Page titles 2018-11-29 12:37:01 +01:00
page_not_found.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
pid_stats.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
please_wait.lua Fix database migration page redirection 2019-01-03 11:21:35 +01:00
pool_details.lua Add missing active_page 2018-12-12 10:18:21 +01:00
pool_stats.lua Fixes blocked/dropped flows labels 2018-12-12 14:57:57 +01:00
port_details.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
process_details.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
processes_stats.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
reset_stats.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
resolve_address.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
runtime.lua [Security] Fixes possible stored XSS in runtime.lua 2019-03-14 13:05:04 +01:00
sflow_tree.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
show_alerts.lua Page titles 2018-11-29 12:37:01 +01:00
show_geolocation_note.lua Add per IP shaper rate fields 2018-02-20 15:06:04 +01:00
sprobe.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
sprobe_data.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
sprobe_host_process.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
sprobe_host_process_data.lua Old sprobe code cleanup 2018-11-06 15:38:49 +01:00
stop_live_capture.lua Script for stopping live captures 2018-08-08 16:35:59 +02:00
test_locales.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
test_snmp.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
top_hosts.lua Fix top hosts links 2018-12-20 18:39:31 +01:00
traffic_extraction.lua Add chart link in traffic extraction jobs 2018-11-14 12:00:15 +01:00
traffic_extraction_data.lua Traffic recording gui improvements 2018-11-14 19:29:58 +01:00
unknown_devices.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
user_stats.lua Updated (C) to 2018 2018-03-22 21:59:42 +01:00
username_details.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
vlan_details.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00
vlan_stats.lua Moved header for all pages to page_utils 2018-11-29 18:10:18 +01:00