×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

xss on rv042 login page

Unanswered Question
Nov 9th, 2011
User Badges:

i recently got an rv042 and updated to the most recent (v4.0.4.02-tm  (Jul  4 2011 13:30:56)) firmware. but the input to the login page isn't  sanitized and seems to be a gaping xss vulnerability. if i enter


aa");alert("xss!


as a username with  any password it tells me it's invalid. but then if i login and look at  the system log i'll see a javascript alert pop up. so anybody who can  access the management interface can enter iframes or javascript and next  time i look at the log it'll all execute in my browser. how did that  get past testing? it pretty much makes the log useless. any chance this will get fixed in a future firmware update?


edit - looks like disabling Unauthorized Login Attempt logging will prevent the username from being written into the log. so that mitigates the danger. but it's enabled by default and that's the kind of thing i like to see in logs. seems like it deserves a fix.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.

Actions

This Discussion

Related Content