Werk #5431

KomponenteGUI
TitelFixed possible reflected XSS using custom bookmarks
Datum2017-11-03 10:27:43
Check_MK EditionCheck_MK Raw Edition (CRE)
Check_MK Version1.4.0p17,1.5.0i1
Level1 - Trivial Change
KlasseSecurity Fix
KompatibilitätKompatibel- benötigt keine manuelles eingreifen

It was possible to create custom bookmarks by making the user open a crafted URL. This created a bookmark in the users default bookmark list which could be used to execute custom javascript code when the user clicks on the just created link.

For example the user session cookies can be read and reported to the attackers, who could then hijack the users sessions with the application.

This issue has been fixed by limiting absolute URLs in bookmarks to the URL schemes https and http.