#5241 apcupsd upsstats_wrapper.cgi default host param=127.0.0.1 resulting in "reflected XSS" attack

[Fermulator]

The apcupsd module, drilled into UPS stats results in webmin thinking we're doing an XSS attack(?)

I have a UPS monitored by apcupsd, and webmin by default ships with the module for it (iirc).

1. Login to Webmin
2. Under "Others", hit up "APC UPS Daemon"

3. https://192.168.0.3:10000/apcupsd/

See attachment for "default view" of the module.

OK so if you click on "Local Host" (under the system column), it shows the user some more details about the UPS with some fancy diagrams and other functionality;

the URL path it brings us to:

https://192.168.0.3:10000/apcupsd/upsstats_wrapper.cgi?host=127.0.0.1&temp=C

hmmm, herein lies the problem ^^^; we can see that the host param is set to 127.0.0.1 (localhost), which could be fine... EXCEPT within a few seconds webmin complains:

    Security Warning    
Warning! Webmin has detected that the program https://192.168.0.3:10000/apcupsd/upsstats_wrapper.cgi?host=127.0.0.1&temp=C was linked to from an unknown URL, which appears to be outside the Webmin server. This may be an attempt to trick your server into executing a dangerous command.

Make sure your browser is configured to send referrer information so that it can be verified by Webmin.

Alternately, you can configure Webmin to allow links from unknown referers by :

    Login as root, and edit the /etc/webmin/config file.
    Find the line referers_none=1 and change it to referers_none=0.
    Save the file.

WARNING - this has the side effect of opening your system up to reflected XSS attacks and so is not recommended!!

I don't think this is the right default behaviour. We definitely don't really want to have these defaults which MAY result in users opening up their system to reflected XSS attacks.

[Fermulator]

Few extra debug/notes

not sure why this is empty

# pwd
/var/webmin/modules/apcupsd

# ll
total 0

The apcupsd configuration file of note, (on my system) has its NISIP value set like this:

# NISIP <dotted notation ip address>
#  IP address on which NIS server will listen for incoming connections.
#  This is useful if your server is multi-homed (has more than one
#  network interface and IP address). Default value is 0.0.0.0 which
#  means any incoming request will be serviced. Alternatively, you can
#  configure this setting to any specific IP address of your server and 
#  NIS will listen for connections only on that interface. Use the
#  loopback address (127.0.0.1) to accept connections only from the
#  local machine.
NISIP 127.0.0.1

I have two systems, this appears to be the default on both my Debian and CentOS based systems.
Also I doubt the RCA would be the raw daemon's config anyway.

Here's the apcupsd config

# cat /etc/webmin/apcupsd/config 
update_interval=30
multimon.cgi=/etc/apcupsd/multimon.cgi
upsstats.cgi=/etc/apcupsd/upsstats.cgi
upsfstats.cgi=/etc/apcupsd/upsfstats.cgi
start_cmd=/etc/rc.d/init.d/apcupsd start
stop_cmd=/etc/rc.d/init.d/apcupsd stop
upsimage.cgi=/etc/apcupsd/upsimage.cgi
apcupsd_conf_file=/etc/apcupsd/apcupsd.conf

Within the actual cgi script

# pwd
/usr/libexec/webmin/apcupsd

#!/usr/bin/perl
#       upsstats_wrapper.cgi 
#

require './apcupsd-lib.pl';

$whatfailed=$text{'alib_xferr'};
if(! -x $config{'upsstats.cgi'}){ &error($config{'upsstats.cgi'}) };
if(! -x $config{'upsimage.cgi'}){ &error($config{'upsimage.cgi'}) };

if($config{'update_interval'} ne '0') {
  $metas="<META HTTP-EQUIV=\"Refresh\" CONTENT=\"$config{'update_interval'}, URL=/$module_name/$ENV{'SCRIPT_NAME'}\">\n\
         <META HTTP-EQUIV=\"Pragma\" CONTENT=\"nocache\">\n";
  }
else {
  $metas='';
  }
&header($text{'asw_header'}, "", "upsstats", 1, 1,undef,undef, $metas);

print "<h2>$text{'asw_msg1'}</h2> <br> <hr>";
$whatfailed=$text{''};
#------------------------------------------------------------------------
open (UPSSTATS,"$config{'upsstats.cgi'}|") or 
        &error($config{'upsstats.cgi'});
while(<UPSSTATS>) {
  next if /^Content-type: text\/html$/;
  next if /^Pragma: no-cache$/;
  s/upsstats\.cgi/upsstats_wrapper\.cgi/g;
  s/upsimage\.cgi/upsimage_wrapper\.cgi/g;
  print;          
  }
#------------------------------------------------------------------------
print "<hr>\n";
&footer("/$module_name",$text{'asw_return'});

This leads me to believe we're into the "update/refresh" logic of the code. As the page initially loads fine, but then shortly thereafter (i.e. the update_interval attempts to refresh the sub-page in the module then fails).

# file /etc/apcupsd/upsstats.cgi
/etc/apcupsd/upsstats.cgi: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=d603a57203ad3a46224c41cfe3e97a8e5cdea706, stripped

From the wrapper CGI code, I can't really see where/how the metas get suffixed by ?host=127.0.0.1&temp=C ...

[Fermulator]

as a "PS/confused" note .. I'm confused where this module even comes from (where does the source code live?)

I can't find it in the github repo:

(even pulled it down and tried searching ... empty results

 grep -rins apcupsd *
 find . | grep apcupsd

nor does it seem to qualify as a "3rd party module"
http://www.webmin.com/cgi-bin/search_third.cgi?search=apcups

hmmm

[Ilia]

Hi,

This module is outdated. Besides, this module is not in the default list, and not distributed with Webmin package.

The problem is becase the page is being refreshed/redirected incorrectly. There should be module configuration and you can disable automatic refresh.

You can write JavaScript extension for Webmin/Authentic Theme to make it automatically refresh the page every needed amount of seconds.

I also discovered that author can be contacted via support at bks.da.ru.

[Fermulator]

Hi thanks for the reply.

How/where did you find reference to this module btw? (please provide a link if you are able)

I am curious also how this module showed up in my webmin installation. I did not manually add any 3rd party modules myself. Perhaps it gets installed automatically by the apcupsd package manager on Linux? (it appears on both dnf and apt systems the same)

Have sent a support request to the above-noted e-mail to author for attention.