From ca3fbcd57d0f66ef710c2c0b78a1d416d4aec653 Mon Sep 17 00:00:00 2001 From: Nagalakshmi Veeramallu Date: Fri, 29 Jun 2018 15:38:25 +0530 Subject: CVE-2018-11652 nikto: arbitray OS command injection via http server field. CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report. Signed-off-by: Nagalakshmi Veeramallu Reviewed-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster --- recipes-security/nikto/files/CVE-2018-11652.patch | 106 ++++++++++++++++++++++ recipes-security/nikto/nikto_2.1.5.bb | 3 +- 2 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 recipes-security/nikto/files/CVE-2018-11652.patch diff --git a/recipes-security/nikto/files/CVE-2018-11652.patch b/recipes-security/nikto/files/CVE-2018-11652.patch new file mode 100644 index 0000000..5ddb169 --- /dev/null +++ b/recipes-security/nikto/files/CVE-2018-11652.patch @@ -0,0 +1,106 @@ +From e759b3300aace5314fe3d30800c8bd83c81c29f7 Mon Sep 17 00:00:00 2001 +From: sullo +Date: Thu, 31 May 2018 23:30:03 -0400 +Subject: [PATCH] Fix CSV injection issue if server responds with a malicious + Server string & CSV output is opened in Excel or other spreadsheet app. + Potentially malicious cell start characters are now prefaced with a ' mark. + Thanks to Adam (@bytesoverbombs) for letting me know! + +Also fixed a crash in the outdated plugin if the $sepr field ends up being something that triggers a panic in split(). + +CVE: CVE-2018-11652 +Upstream-Status: Backport +Signed-off-by: Nagalakshmi Veeramallu +--- + plugins/nikto_outdated.plugin | 2 +- + plugins/nikto_report_csv.plugin | 42 +++++++++++++++++++++++++++++------------ + 2 files changed, 31 insertions(+), 13 deletions(-) + +diff --git a/plugins/nikto_outdated.plugin b/plugins/nikto_outdated.plugin +index 72379cc..eb1d889 100644 +--- a/plugins/nikto_outdated.plugin ++++ b/plugins/nikto_outdated.plugin +@@ -83,7 +83,7 @@ sub nikto_outdated { + $sepr = substr($sepr, (length($sepr) - 1), 1); + + # break up ID string on $sepr +- my @T = split(/$sepr/, $mark->{'banner'}); ++ my @T = split(/\\$sepr/, $mark->{'banner'}); + + # assume last is version... + for ($i = 0 ; $i < $#T ; $i++) { $MATCHSTRING .= "$T[$i] "; } +diff --git a/plugins/nikto_report_csv.plugin b/plugins/nikto_report_csv.plugin +index d13acab..b942e78 100644 +--- a/plugins/nikto_report_csv.plugin ++++ b/plugins/nikto_report_csv.plugin +@@ -52,10 +52,12 @@ sub csv_open { + sub csv_host_start { + my ($handle, $mark) = @_; + $mark->{'banner'} =~ s/"/\\"/g; +- print OUT "\"$mark->{'hostname'}\"," +- . "\"$mark->{'ip'}\"," +- . "\"$mark->{'port'}\"," . "\"\"," . "\"\"," . "\"\"," +- . "\"$mark->{'banner'}\"\n"; ++ print $handle "\"" . csv_safecell($hostname) . "\"," ++ . "\"" . csv_safecell($mark->{'ip'}) . "\"," ++ . "\"" . csv_safecell($mark->{'port'}) . "\"," . "\"\"," . "\"\"," . "\"\"," ++ #. "\"" . $mark->{'banner'} . "\"\n"; ++ . "\"" . csv_safecell($mark->{'banner'}) . "\"\n"; ++ + return; + } + +@@ -65,26 +67,42 @@ sub csv_item { + my ($handle, $mark, $item) = @_; + foreach my $uri (split(' ', $item->{'uri'})) { + my $line = ''; +- $line .= "\"$item->{'mark'}->{'hostname'}\","; +- $line .= "\"$item->{'mark'}->{'ip'}\","; +- $line .= "\"$item->{'mark'}->{'port'}\","; ++ $line .= "\"" . csv_safecell($hostname) . "\","; ++ $line .= "\"" . csv_safecell($item->{'mark'}->{'ip'}) . \","; ++ $line .= "\"" . csv_safecell($item->{'mark'}->{'port'}) . "\","; + + $line .= "\""; + if ($item->{'osvdb'} ne '') { $line .= "OSVDB-" . $item->{'osvdb'}; } + $line .= "\","; + + $line .= "\""; +- if ($item->{'method'} ne '') { $line .= $item->{'method'}; } ++ if ($item->{'method'} ne '') { $line .= csv_safecell($item->{'method'}); } + $line .= "\","; + + $line .= "\""; +- if ($uri ne '') { $line .= $mark->{'root'} . $uri; } ++ { $line .= csv_safecell($mark->{'root'}) . $uri; } ++ else { $line .= csv_safecell($ur + $line .= "\","; + +- $item->{'message'} =~ s/"/\\"/g; +- $line .= "\"$item->{'message'}\""; +- print $handle "$line\n"; ++ my $msg = $item->{'message'}; ++ $uri=quotemeta($uri); ++ my $root = quotemeta($mark->{'root'}); ++ $msg =~ s/^$uri:\s//; ++ $msg =~ s/^$root$uri:\s//; ++ $msg =~ s/"/\\"/g; ++ $line .= "\"" . csv_safecell($msg) ."\""; ++ print $handle "$line\n"; ++ + } + } + ++############################################################################### ++# prevent CSV injection attacks ++sub csv_safecell { ++ my $celldata = $_[0] || return; ++ if ($celldata =~ /^[=+@-]/) { $celldata = "'" . $celldata; } ++ return $celldata; ++} ++ ++ + 1; +-- +2.6.4 + diff --git a/recipes-security/nikto/nikto_2.1.5.bb b/recipes-security/nikto/nikto_2.1.5.bb index 8080d4a..19eb14f 100644 --- a/recipes-security/nikto/nikto_2.1.5.bb +++ b/recipes-security/nikto/nikto_2.1.5.bb @@ -7,7 +7,8 @@ LICENSE = "GPLv2" LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/GPL-2.0;md5=801f80980d171dd6425610833a22dbe6" SRC_URI = "http://cirt.net/nikto/${BP}.tar.gz \ - file://location.patch" + file://location.patch \ + file://CVE-2018-11652.patch" SRC_URI[md5sum] = "efcc98a918becb77471ee9a5df0a7b1e" SRC_URI[sha256sum] = "0e672a6a46bf2abde419a0e8ea846696d7f32e99ad18a6b405736ee6af07509f" -- cgit v1.2.3-54-g00ecf