From ee3f5de1debd5a8da0b207fe732ac1549625f756 Mon Sep 17 00:00:00 2001 From: Andy Taylor Date: Tue, 14 Oct 2025 14:15:20 +0100 Subject: [PATCH 1/5] XSS Vulnerability Patches and Security Enhancements for Dashboard1 --- dashboard/changes.txt | 96 +++++++++ dashboard/index.php | 62 ++++-- dashboard/pgs/class.interlink.php | 50 +++-- dashboard/pgs/class.node.php | 57 ++++-- dashboard/pgs/class.parsexml.php | 32 +-- dashboard/pgs/class.peer.php | 31 ++- dashboard/pgs/class.reflector.php | 318 +++++++++++++++++++----------- dashboard/pgs/class.station.php | 42 ++-- dashboard/pgs/config.inc.php | 13 +- dashboard/pgs/functions.php | 91 ++++++++- dashboard/pgs/modules.php | 20 +- dashboard/pgs/peers.php | 24 +-- dashboard/pgs/reflectors.php | 14 +- dashboard/pgs/repeaters.php | 51 +++-- dashboard/pgs/traffic.php | 47 ++--- dashboard/pgs/users.php | 83 ++++---- 16 files changed, 701 insertions(+), 330 deletions(-) diff --git a/dashboard/changes.txt b/dashboard/changes.txt index 5d18d53..8b43388 100755 --- a/dashboard/changes.txt +++ b/dashboard/changes.txt @@ -1,3 +1,99 @@ +xlx db v2.4.3 + +SECURITY UPDATE - All files updated to fix vulnerabilities + +This release addresses multiple security vulnerabilities including XSS (Cross-Site Scripting), +command injection, path traversal, and SSRF (Server-Side Request Forgery) attacks. + +Files Changed and Security Fixes: + +- "functions.php" + * Added sanitize_output() and sanitize_attribute() helper functions for XSS prevention + * Added validate_callsign(), validate_module(), validate_protocol() input validation functions + * Replaced exec() call in GetSystemUptime() with secure file reading from /proc/uptime + * Added input validation and shell argument escaping to VNStatGetData() + * Added array bounds checking to ParseTime() to prevent errors on malformed input + +- "class.interlink.php" + * Added input validation to SetName() - validates reflector name format + * Added input validation to SetAddress() - validates IP addresses and hostnames + * Added input validation to AddModule(), RemoveModule(), and HasModuleEnabled() + +- "class.node.php" + * Added input validation in constructor for all parameters + * IP addresses validated with filter_var() + * Protocol validated against whitelist + * Callsign format validated with regex + * LinkedModule validated as single A-Z letter + +- "class.parsexml.php" + * Added element name sanitization to prevent XML injection + * Added strip_tags() to remove HTML/XML from extracted content + +- "class.peer.php" + * Added input validation in constructor for all parameters + * Same validation as class.node.php for consistency + +- "class.reflector.php" + * Added path traversal prevention to SetXMLFile(), SetPIDFile(), and SetFlagFile() + * Added SSRF protection to CallHome() - blocks internal/private IP addresses + * Added validation to ReadInterlinkFile() to prevent path traversal + * Added XML entity encoding to PrepareInterlinkXML() and PrepareReflectorXML() + * Added URL validation to SetCallingHome() + * Added missing InterlinkCount(), GetInterlink(), and IsInterlinked() methods + +- "class.station.php" + * Added input validation in constructor for all parameters + * Callsign format validation + * Module validation + +- "config.inc.php" + * Secured external config file inclusion with path validation + * Added realpath() checks to prevent directory traversal + +- "modules.php" + * All output wrapped with sanitize_output() to prevent XSS + +- "peers.php" + * All peer data output sanitized with sanitize_output() and sanitize_attribute() + * URL and callsign outputs properly escaped + +- "reflectors.php" + * All XML element data sanitized before output + * Dashboard URLs and reflector names properly escaped + +- "repeaters.php" + * Added input validation for filter parameters + * All node/repeater data sanitized before output + * Flag images and URLs properly escaped + * IP addresses sanitized + +- "traffic.php" + * Added strict whitelist validation for interface parameter + * Interface names validated against configured list only + +- "users.php" + * Added input validation for filter parameters + * All station/user data sanitized before output + * Callsigns, suffixes, and module names properly escaped + +- "index.php" + * Added secure session configuration (HttpOnly, SameSite, Secure flags) + * Added security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy) + * Added whitelist validation for 'show' parameter + * Added validation for 'do' and 'callhome' parameters + * All configuration values sanitized before output to HTML + * JavaScript injection prevented in page refresh code + * All meta tags properly escaped + +Security Vulnerabilities Fixed: +- XSS (Cross-Site Scripting) - All user input and XML data now properly escaped +- Command Injection - Removed unsafe exec() calls, added shell argument escaping +- Path Traversal - File paths validated and restricted to expected directories +- SSRF (Server-Side Request Forgery) - CallHome validates URLs and blocks internal IPs +- Session Hijacking - Added HttpOnly, SameSite, and Secure cookie flags +- XML Injection - Element names sanitized, content stripped of tags + xlx db v2.4.1 you can now hide the liveircddb menu button, if you are running your db in https. diff --git a/dashboard/index.php b/dashboard/index.php index 19b8833..b8cc31c 100755 --- a/dashboard/index.php +++ b/dashboard/index.php @@ -1,9 +1,22 @@ SetFlagFile("./pgs/country.csv"); $Reflector->SetPIDFile($Service['PIDFile']); @@ -81,14 +115,14 @@ else { - - - - - + + + + + - <?php echo $Reflector->GetReflectorName(); ?> Reflector Dashboard + <?php echo sanitize_output($Reflector->GetReflectorName()); ?> Reflector Dashboard "); if ((BodyStart >= 0) && (BodyEnd > BodyStart)) { @@ -130,14 +164,14 @@ else {
XLX Multiprotocol Gateway Reflector -
   GetReflectorName(); ?> vGetVersion(); ?> - Dashboard v   /  Service uptime: GetServiceUptime()); ?>
+
   GetReflectorName()); ?> vGetVersion()); ?> - Dashboard v   /  Service uptime: GetServiceUptime()); ?>