Bug#1031542: dbeacon: XSS Vulnerability in matrix.pl

[Raoul Gunnar Borenius]

Package: dbeacon
Version: 0.4.0-2+b2
Severity: important
Tags: patch upstream

Dear Maintainer,

the included CGI script /usr/share/dbeacon/matrix.pl is vulnerable to
XSS attacks as it does not do proper input validation.

A patch that mitigates the problem is included.

Cheers,

 Raoul

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-5-amd64 (SMP w/1 CPU thread; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL 
set to en_US.UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dbeacon depends on:
ii  adduser                    3.131
ii  libc6                      2.36-8
ii  libgcc-s1                  12.2.0-14
ii  libstdc++6                 12.2.0-14
ii  lsb-base                   11.6
ii  sysvinit-utils [lsb-base]  3.06-2

Versions of packages dbeacon recommends:
ii  libxml-parser-perl  2.46-4
ii  perl                5.36.0-7

Versions of packages dbeacon suggests:
pn  librrds-perl  <none>

-- no debconf information

--- /usr/share/dbeacon/matrix.pl        2016-06-20 13:46:15.000000000 +0200
+++ matrix.pl   2023-02-18 09:20:28.861711524 +0100
@@ -10,7 +10,7 @@
 #
 #   Perl code improvement suggestions by Marco d'Itri
 
-use CGI;
+use CGI; use HTML::Entities;
 use XML::Parser;
 use POSIX qw(strftime);
 use Time::HiRes qw(gettimeofday tv_interval);
@@ -97,13 +97,13 @@
 my $page = new CGI;
 my $url = $page->script_name().'?';
 
-my $dst = $page->param('dst');
-my $src = $page->param('src');
-my $type = $page->param('type');
-my $age = $page->param('age');
-my $at = $page->param('at');
+my $dst = $page->param('dst');         $dst = HTML::Entities::encode($dst);
+my $src = $page->param('src');         $src = HTML::Entities::encode($src);
+my $type = $page->param('type');       $type = HTML::Entities::encode($type);
+my $age = $page->param('age');         $age = HTML::Entities::encode($age);
+my $at = $page->param('at');           $at = HTML::Entities::encode($at);
 
-my $beacon_id = $page->param('id');
+my $beacon_id = $page->param('id');    $beacon_id = 
HTML::Entities::encode($beacon_id);
 if ($beacon_id) {
     -d $beacon_config_base && -f "$beacon_config_base/$beacon_id/matrix.conf" 
        && do "$beacon_config_base/$beacon_id/matrix.conf";
@@ -171,11 +171,11 @@
 sub build_vertex_one {
        my ($dstaddr, $srcaddr, $index, $path) = @_;
 
-       my ($start, $step, $names, $data);
+       my ($start, $step, $names, $data); my $at = $page->param('at'); $at = 
HTML::Entities::encode($at);
 
        ($start, $step, $names, $data) =
                $RRDs::{fetch}($path, 'AVERAGE', '-s',
-               $page->param('at'), '-e', $page->param('at'));
+               $at, '-e', $at);
 
        return [-1, -1] if $RRDs::{error};
 
@@ -497,7 +497,7 @@
 
                printx '<select name="offset" style="margin-left: 0.5em; 
margin-right: 0.5em">'."\n";
 
-               my $ammount = $page->param('ammount');
+               my $ammount = $page->param('ammount'); $ammount = 
HTML::Entities::encode($ammount);
                $ammount ||= 60;
 
                my @ammounts = ([60, '60 s'], [600, '10m'], [3600, '1h'], 
[14400, '4h'], [43200, '12h'], [86400, '24h'], [604800, '7d'], [2592000, 
'30d']);
@@ -718,11 +718,11 @@
 sub render_matrix {
        my ($start, $step) = @_;
 
-       my $attname = $page->param('att');
-       my $atthideinfo = $page->param('hideinfo');
-       my $attwhat = $page->param('what');
-       my $full_matrix = $page->param('full');
-       my $show_lastupdate = $page->param('showlastupdate');
+       my $attname = $page->param('att');                      $attname = 
HTML::Entities::encode($attname);
+       my $atthideinfo = $page->param('hideinfo');             $atthideinfo = 
HTML::Entities::encode($atthideinfo);
+       my $attwhat = $page->param('what');                     $attwhat = 
HTML::Entities::encode($attwhat);
+       my $full_matrix = $page->param('full');                 $full_matrix = 
HTML::Entities::encode($full_matrix);
+       my $show_lastupdate = $page->param('showlastupdate');   
$show_lastupdate = HTML::Entities::encode($show_lastupdate);
 
        $attname ||= 'ttl';
        $atthideinfo ||= $default_hideinfo;
@@ -733,7 +733,7 @@
 
        $what_td = 'colspan="2"' if $attwhat eq 'both';
 
-       my $attat = $page->param('at');
+       my $attat = $page->param('at'); $attat = HTML::Entities::encode($attat);
        $attat = 0 if not defined $attat or $attat eq '';
 
        my $addinfo = '';