XSS - rtr param

[lorenzodifuccia]

During a security test I found that routers2.cgi has a Cross-Site Scripting (XSS) vulnerability, affecting the rtr GET parameter in the request below. This may enable attackers to inject malicious scripts into client browser.

http://www.steveshipway.org/cgi-bin/routers2.pl?rtr=--><script>alert("XSS")</script>&bars=Cami&xgtype=d&page=graph&xgstyle=l2&xmtype=routers

Cause:
print "<!-- R:[$router]\n I:[$interface]\n A:[$archive]\n U:[$authuser] -->\n";

All the params returned in the HTML should be escaped.

[sshipway]

Nice catch. I think this only affects if the debug is enabled (you get more debugging comments in the page in this case) but it should still be addressed of course. Probably the best way to deal with it is to disallow '<' in the router name entirely (and also other dangerous characters like '/' which may break the code elsewhere)

I'm not doing active development on routers2 any more but will fix this in the repo

[lorenzodifuccia]

The following CVE ID has been assigned to this vulnerability: CVE-2018-6193

[sshipway]

Fixed in the master branch. This vulnerability also affect the interface parameter, and can potentially allow access to graphs in subfolders not normally accessible.

Note that this vulnerability does not affect hosts with the paranoia setting enabled in the web section of the routers2.conf (as this disables the affected comment code)

[sshipway]

I'll make a new release once I've completed testing on the fix.

[lorenzodifuccia]

Thanks for your time and for the will to make product secure!!