During the review of this project, a Reflected XSS vulnerability was discovered. An attacker could exploit this vulnerability to execute actions on behalf of other users or potentially take over their accounts.
if (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], 'graphs_new') === false) {
set_request_var('returnto', basename($_SERVER['HTTP_REFERER']));
}
load_current_session_value('returnto', 'sess_grn_returnto', '');
if (strpos(get_nfilter_request_var('returnto'), 'host.php') === false) {
set_request_var('returnto', '');
}
form_save_button(get_nfilter_request_var('returnto'), 'create');function form_save_button($cancel_url, $force_type = '', $key_field = 'id', $ajax = true) {
// ...
if ($force_type != 'import' && $force_type != 'export' && $force_type != 'save' && $force_type != 'close' && $cancel_url != '') {
$cancel_action = "<input type='button' class='ui-button ui-corner-all ui-widget' onClick='cactiReturnTo(\"" . html_escape($cancel_url, ENT_QUOTES) . "\")' value='" . $calt . "'>";
} else {
$cancel_action = '';
}
?>
<table style='width:100%;text-align:center;'>
<tr>
<td class='saveRow'>
<input type='hidden' name='action' value='save'>
<?php print $cancel_action;?>
<input type='submit' class='<?php print $force_type;?> ui-button ui-corner-all ui-widget' id='submit' value='<?php print $alt;?>'>
</td>An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. The attacker could also potentially take over user accounts completely, undermining the integrity of user interactions within the system.
x4vak Reporter
Summary
During the review of this project, a Reflected XSS vulnerability was discovered. An attacker could exploit this vulnerability to execute actions on behalf of other users or potentially take over their accounts.
Details
The vulnerability is found in
graphs_new.php. Several validations are performed, but thereturntoparameter is directly passed toform_save_button. In order to bypass this validation, returnto must containhost.php.The
form_save_buttonfunction handles thereturntoparameter as thecancel_urlvariable. Although thecancel_urlvariable is escaped with thehtml_escapefunction, it is reflected inside the onClick attribute. SincecactiReturnTois a JavaScript function used for redirection, it's possible to execute arbitrary scripts by utilizing thejavascript://scheme.PoC
Impact
An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. The attacker could also potentially take over user accounts completely, undermining the integrity of user interactions within the system.