Reflected XSS in Squert

[Manuel Mancera]

Hello, I reported a reflected cross site scripting vulnerability in Squert. https://github.com/int13h/squert/issues/76

I inform to this mailing list because Squert is being using in this linux distro, so if someone are contributing to Squert and has time to fix it...

[Doug Burks]

Hi Manuel,

I've created Issue 967 for this:
https://github.com/Security-Onion-Solutions/security-onion/issues/967

On Wed, Jul 27, 2016 at 12:49 PM, Manuel Mancera <sink...@gmail.com> wrote:
> Hello, I reported a reflected cross site scripting vulnerability in Squert. https://github.com/int13h/squert/issues/76
>
> I inform to this mailing list because Squert is being using in this linux distro, so if someone are contributing to Squert and has time to fix it...
>

> --
> Follow Security Onion on Twitter!
> https://twitter.com/securityonion
> ---
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at https://groups.google.com/group/security-onion.
> For more options, visit https://groups.google.com/d/optout.



--
Doug Burks

[Doug Burks]

I've packaged a new version of Squert which no longer has the
vulnerable web interface in ip2c.php. I've submitted that package to
our security-onion-testing mailing list for testing before release:
https://groups.google.com/d/topic/security-onion-testing/d1N7HF5y5u0/discussion

--
Doug Burks

[Wes]

Should https:/localhost/squert/.inc/ip2pc.php still be accessible?

Thanks,
Wes

[Doug Burks]

Hi Wes,

My guess is you're not running securityonion-squert -
20141015-0ubuntu0securityonion16 as it hasn't finished copying to
ppa:securityonion/test yet.

[Wes]

Of course, maybe I need to be more patient :)

Thanks,
Wes

[Doug Burks]

Launchpad reports that securityonion-squert -
20141015-0ubuntu0securityonion16 should be available now.

[Doug Burks]

To clarify, Launchpad reports that securityonion-squert -
20141015-0ubuntu0securityonion16 should be available at
ppa:securityonion/test now. Please discuss via security-onion-testing
mailing list:
https://groups.google.com/d/topic/security-onion-testing/d1N7HF5y5u0/discussion

--
Doug Burks

[Doug Burks]

published:
http://blog.securityonion.net/2016/08/securityonion-squert-20141015.html

--
Doug Burks