From: Nagalakshmi Veeramallu <nveerama...@mvista.com>
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers
to inject arbitrary OS commands via the Server field in an HTTP response header,
which is directly injected into a CSV report.
Signed-off-by: Nagalakshmi Veeramallu <nveerama...@mvista.com>
Reviewed-by: Jagadeesh Krishnanjanappa <jkrishnanjana...@mvista.com>
Signed-off-by: Armin Kuster <akus...@mvista.com>
---
recipes-security/nikto/files/CVE-2018-11652.patch | 106 ++++++++++++++++++++++
recipes-security/nikto/nikto_2.1.5.bb | 3 +-
2 files changed, 108 insertions(+), 1 deletion(-)
create mode 100644 recipes-security/nikto/files/CVE-2018-11652.patch
diff --git a/recipes-security/nikto/files/CVE-2018-11652.patch
b/recipes-security/nikto/files/CVE-2018-11652.patch
new file mode 100644
index 0000000..5ddb169
--- /dev/null
+++ b/recipes-security/nikto/files/CVE-2018-11652.patch
@@ -0,0 +1,106 @@
+From e759b3300aace5314fe3d30800c8bd83c81c29f7 Mon Sep 17 00:00:00 2001
+From: sullo <su...@cirt.net>
+Date: Thu, 31 May 2018 23:30:03 -0400
+Subject: [PATCH] Fix CSV injection issue if server responds with a malicious
+ Server string & CSV output is opened in Excel or other spreadsheet app.
+ Potentially malicious cell start characters are now prefaced with a ' mark.
+ Thanks to Adam (@bytesoverbombs) for letting me know!
+
+Also fixed a crash in the outdated plugin if the $sepr field ends up being
something that triggers a panic in split().
+
+CVE: CVE-2018-11652
+Upstream-Status: Backport
+Signed-off-by: Nagalakshmi Veeramallu <nveerama...@mvista.com>
+---
+ plugins/nikto_outdated.plugin | 2 +-
+ plugins/nikto_report_csv.plugin | 42 +++++++++++++++++++++++++++++------------
+ 2 files changed, 31 insertions(+), 13 deletions(-)
+
+diff --git a/plugins/nikto_outdated.plugin b/plugins/nikto_outdated.plugin
+index 72379cc..eb1d889 100644
+--- a/plugins/nikto_outdated.plugin
++++ b/plugins/nikto_outdated.plugin
+@@ -83,7 +83,7 @@ sub nikto_outdated {
+ $sepr = substr($sepr, (length($sepr) - 1), 1);
+
+ # break up ID string on $sepr
+- my @T = split(/$sepr/, $mark->{'banner'});
++ my @T = split(/\\$sepr/, $mark->{'banner'});
+
+ # assume last is version...
+ for ($i = 0 ; $i < $#T ; $i++) { $MATCHSTRING .= "$T[$i] "; }
+diff --git a/plugins/nikto_report_csv.plugin b/plugins/nikto_report_csv.plugin
+index d13acab..b942e78 100644
+--- a/plugins/nikto_report_csv.plugin
++++ b/plugins/nikto_report_csv.plugin
+@@ -52,10 +52,12 @@ sub csv_open {
+ sub csv_host_start {
+ my ($handle, $mark) = @_;
+ $mark->{'banner'} =~ s/"/\\"/g;
+- print OUT "\"$mark->{'hostname'}\","
+- . "\"$mark->{'ip'}\","
+- . "\"$mark->{'port'}\"," . "\"\"," . "\"\"," . "\"\","
+- . "\"$mark->{'banner'}\"\n";
++ print $handle "\"" . csv_safecell($hostname) . "\","
++ . "\"" . csv_safecell($mark->{'ip'}) . "\","
++ . "\"" . csv_safecell($mark->{'port'}) . "\"," . "\"\"," . "\"\"," .
"\"\","
++ #. "\"" . $mark->{'banner'} . "\"\n";
++ . "\"" . csv_safecell($mark->{'banner'}) . "\"\n";
++
+ return;
+ }
+
+@@ -65,26 +67,42 @@ sub csv_item {
+ my ($handle, $mark, $item) = @_;
+ foreach my $uri (split(' ', $item->{'uri'})) {
+ my $line = '';
+- $line .= "\"$item->{'mark'}->{'hostname'}\",";
+- $line .= "\"$item->{'mark'}->{'ip'}\",";
+- $line .= "\"$item->{'mark'}->{'port'}\",";
++ $line .= "\"" . csv_safecell($hostname) . "\",";
++ $line .= "\"" . csv_safecell($item->{'mark'}->{'ip'}) . \",";
++ $line .= "\"" . csv_safecell($item->{'mark'}->{'port'}) . "\",";
+
+ $line .= "\"";
+ if ($item->{'osvdb'} ne '') { $line .= "OSVDB-" . $item->{'osvdb'}; }
+ $line .= "\",";
+
+ $line .= "\"";
+- if ($item->{'method'} ne '') { $line .= $item->{'method'}; }
++ if ($item->{'method'} ne '') { $line .=
csv_safecell($item->{'method'}); }
+ $line .= "\",";
+
+ $line .= "\"";
+- if ($uri ne '') { $line .= $mark->{'root'} . $uri; }
++ { $line .= csv_safecell($mark->{'root'}) . $uri; }
++ else { $line .= csv_safecell($ur
+ $line .= "\",";
+
+- $item->{'message'} =~ s/"/\\"/g;
+- $line .= "\"$item->{'message'}\"";
+- print $handle "$line\n";
++ my $msg = $item->{'message'};
++ $uri=quotemeta($uri);
++ my $root = quotemeta($mark->{'root'});
++ $msg =~ s/^$uri:\s//;
++ $msg =~ s/^$root$uri:\s//;
++ $msg =~ s/"/\\"/g;
++ $line .= "\"" . csv_safecell($msg) ."\"";
++ print $handle "$line\n";
++
+ }
+ }
+
++###############################################################################
++# prevent CSV injection attacks
++sub csv_safecell {
++ my $celldata = $_[0] || return;
++ if ($celldata =~ /^[=+@-]/) { $celldata = "'" . $celldata; }
++ return $celldata;
++}
++
++
+ 1;
+--
+2.6.4
+
diff --git a/recipes-security/nikto/nikto_2.1.5.bb
b/recipes-security/nikto/nikto_2.1.5.bb
index 8080d4a..19eb14f 100644
--- a/recipes-security/nikto/nikto_2.1.5.bb
+++ b/recipes-security/nikto/nikto_2.1.5.bb
@@ -7,7 +7,8 @@ LICENSE = "GPLv2"
LIC_FILES_CHKSUM =
"file://${COMMON_LICENSE_DIR}/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6"
SRC_URI = "http://cirt.net/nikto/${BP}.tar.gz \
- file://location.patch"
+ file://location.patch \
+ file://CVE-2018-11652.patch"
SRC_URI[md5sum] = "efcc98a918becb77471ee9a5df0a7b1e"
SRC_URI[sha256sum] =
"0e672a6a46bf2abde419a0e8ea846696d7f32e99ad18a6b405736ee6af07509f"
--
2.7.4
--
_______________________________________________
yocto mailing list
yocto@yoctoproject.org
https://lists.yoctoproject.org/listinfo/yocto
