CVE-2013-0275 (PHP, published 2013-03-14T03:12Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ganglia/ganglia-web
Files changed:
actions.php
autorotation.php
compare_hosts.php
decompose_graph.php
graph_all_periods.php
header.php
mobile_helper.php
trend_navigation.php
views.php
views_view.php
Commit message: Escape special characters. Clean up input


Vulnerable code:
     <tr><th>Host regular expression</th><td><?php print join (",", $_GET['hreg']); ?></td></tr>
     <tr><th>Metric regular expression</th><td><?php print join (",", $_GET['mreg']); ?></td></tr>
     <tr><th>Hostname</th><td><?php print $_GET['host_name']; ?></td></tr>
     <tr><th>Metric/Report</th><td><?php print $_GET['metric_name']; ?></td></tr>
	      print '<input type="hidden" name="' . $key .'[]" value="' . $value2 . '" />';
	    print '<input type="hidden" name="' . $key .'" value="' . $value . '" />';
      print "<input type=\"hidden\" name=\"host_name\" value=\"{$_GET['host_name']}\" />";
      print "<input type=\"hidden\" name=\"metric_name\" value=\"{$_GET['metric_name']}\" />";
    <input type="hidden" name="view_name" value="<?php print $_GET['view_name'] ?>">
    $hreg .= "&hreg[]=" . $arg;
  $data->assign("hreg_arg", $_GET['hreg'][0]);
  print "<input type=hidden name=hreg[] value='" . $arg . "'>";
  print "<input type=hidden name=mreg[] value='" . $arg . "'>";
    $query_string_array[] = "$key=" . urlencode($value);
      $query_string_array[] = $key . "[]=" . urlencode($value2);
  $description = $_GET['h'];
  $description = $_GET['c'];
  $description = join(",", $_GET['hreg']);
  $metric_description = $_GET['g'];
  $metric_description = $_GET['m'];
  $metric_description = join(",", $_GET['mreg']);
      <h3><?php if (isset($_GET['g'])) echo $_GET['g']; else echo $_GET['m']; ?></h3>
$data->assign('selected_tab', $user['selected_tab']);
      <h1>View <?php print $_GET['view_name']; ?></h1>
      $range_menu .= "<li><a href='mobile_helper.php?view_name=" . $_GET['view_name'] . "&r=" . $v . "&cs=&ce='>$v</a></li>";
	    $range_args .= "&r=" . $_GET['r'];
	    $range_args .= "&cs=" . $_GET['cs'] . "&ce=" . $_GET['ce'];
      <h3>Cluster <?php print $clustername; ?></h3>
      	     $range_menu .= "<li><a href='mobile_helper.php?show_cluster_metrics=1&c=" . $clustername . "&r=" . $v . "&cs=&ce='>$v</a></li>";
    $graph_args = "c=$clustername&r=$range";
    $cluster_file = $conf['conf_dir'] . "/cluster_" . $clustername . ".json";
	<A HREF=\"./graph_all_periods.php?mobile=1&$graph_args&amp;g=" . $report_name . "&amp;z=mobile&amp;c=$clustername\">
	<IMG BORDER=0 ALT=\"$clustername\" SRC=\"./graph.php?$graph_args&amp;g=" . $report_name ."&amp;z=mobile&amp;c=$clustername\"></A>
  <div data-role="page" class="ganglia-mobile" id="viewhost-<?php print $hostname; ?>">
      <h3>Host <?php print $hostname; ?></h3>
      	     $range_menu .= "<li><a href='mobile_helper.php?show_host_metrics=1&h=" . $hostname . "&c=" . $clustername . "&r=" . $v . "&cs=&ce='>$v</a></li>";
    $graph_args = "h=$hostname&c=$clustername&r=$range";
    $host_file = $conf['conf_dir'] . "/host_" . $hostname . ".json";
	<IMG BORDER=0 ALT=\"$clustername\" SRC=\"./graph.php?$graph_args&amp;g=" . $report_name ."&amp;z=mobile\"></A>";
    $metric_graphargs = "c=$clustername&amp;h=$hostname&amp;v=$metric_attributes[VAL]"
      ."&amp;m=$metric_name&amp;r=$range&amp;z=$size&amp;jr=$jobrange"
	<IMG BORDER=0 ALT=\"$clustername\" SRC=\"./graph.php?" . $g_metrics[$metric_name]['graph'] . "\"></A>";
    $graph_args[] = $key . "=" . str_replace("_/graph_php?", "", $value);
$query_string = preg_replace("/(&trendhistory=)(\d+)/", "", $query_string);
</script>
$base = isset($_GET['base']) ? $_GET['base'] . "/" : "";
	$range_args .= "&amp;r=" . $_GET['r'];
	$range_args .= "&amp;cs=" . $_GET['cs'] . "&amp;ce=" . $_GET['ce'];
          $base = isset($_GET['base']) ? $_GET['base'] : '.';
      $view_filename = $conf['views_dir'] . "/view_" . $view_suffix . ".json";
                  " Can't write to file $view_filename." .
      $view_filename = $conf['views_dir'] . "/view_" . $view_suffix . ".json";

Fixed code:
     <tr><th>Host regular expression</th><td><?php print htmlspecialchars( join (",", $_GET['hreg']) ); ?></td></tr>
     <tr><th>Metric regular expression</th><td><?php print htmlspecialchars( join (",", $_GET['mreg']) ); ?></td></tr>
     <tr><th>Hostname</th><td><?php print htmlspecialchars($_GET['host_name']); ?></td></tr>
     <tr><th>Metric/Report</th><td><?php print htmlspecialchars($_GET['metric_name']); ?></td></tr>
	      print '<input type="hidden" name="' . htmlspecialchars($key) .'[]" value="' . htmlspecialchars($value2) . '" />';
	    print '<input type="hidden" name="' . htmlspecialchars($key) .'" value="' . htmlspecialchars($value) . '" />';
      print "<input type=\"hidden\" name=\"host_name\" value=\"".htmlspecialchars($_GET['host_name'])."\" />";
      print "<input type=\"hidden\" name=\"metric_name\" value=\"".htmlspecialchars($_GET['metric_name'])."\" />";
    <input type="hidden" name="view_name" value="<?php print htmlspecialchars($_GET['view_name']) ?>">
    $hreg .= "&hreg[]=" . rawurlencode($arg);
  $data->assign("hreg_arg", htmlspecialchars($_GET['hreg'][0]) );
  print "<input type=hidden name=hreg[] value='" . htmlspecialchars($arg) . "'>";
  print "<input type=hidden name=mreg[] value='" . htmlspecialchars($arg) . "'>";
    $query_string_array[] = rawurlencode($key) . "=" . urlencode($value);
      $query_string_array[] = rawurlencode($key) . "[]=" . urlencode($value2);
  $description = htmlspecialchars($_GET['h']);
  $description = htmlspecialchars($_GET['c']);
  $description = htmlspecialchars( join(",", $_GET['hreg']) );
  $metric_description = htmlspecialchars($_GET['g']);
  $metric_description = htmlspecialchars($_GET['m']);
  $metric_description = htmlspecialchars( join(",", $_GET['mreg']) );
      <h3><?php if (isset($_GET['g'])) echo htmlspecialchars($_GET['g']); else echo htmlspecialchars($_GET['m']); ?></h3>
$data->assign('selected_tab', htmlspecialchars($user['selected_tab']) );
      <h1>View <?php print htmlspecialchars($_GET['view_name']); ?></h1>
      $range_menu .= "<li><a href='mobile_helper.php?view_name=" . rawurlencode($_GET['view_name']) . "&r=" . $v . "&cs=&ce='>$v</a></li>";
	    $range_args .= "&r=" . rawurlencode($_GET['r']);
	    $range_args .= "&cs=" . rawurlencode($_GET['cs']) . "&ce=" . rawurlencode($_GET['ce']);
      <h3>Cluster <?php print htmlspecialchars($clustername); ?></h3>
      	     $range_menu .= "<li><a href='mobile_helper.php?show_cluster_metrics=1&c=" . rawurlencode($clustername) . "&r=" . $v . "&cs=&ce='>$v</a></li>";
    $graph_args = "c=".rawurlencode($clustername)."&r=".rawurlencode($range);
    $cluster_file = $conf['conf_dir'] . "/cluster_" . preg_replace('/[^a-zA-Z0-9_-]/', '', $clustername) . ".json";
    if ( pathinfo( $cluster_file, PATHINFO_DIRNAME ) != $conf['conf_dir'] ) {
      die('Invalid path detected');
    }
	<A HREF=\"./graph_all_periods.php?mobile=1&$graph_args&amp;g=" . $report_name . "&amp;z=mobile&amp;c=".rawurlencode($clustername)."\">
	<IMG BORDER=0 ALT=\"".rawurlencode($clustername)."\" SRC=\"./graph.php?$graph_args&amp;g=" . $report_name ."&amp;z=mobile&amp;c=".rawurlencode($clustername)."\"></A>
  <div data-role="page" class="ganglia-mobile" id="viewhost-<?php print htmlspecialchars($hostname); ?>">
      <h3>Host <?php print htmlspecialchars($hostname); ?></h3>
      	     $range_menu .= "<li><a href='mobile_helper.php?show_host_metrics=1&h=" . rawurlencode($hostname) . "&c=" . rawurlencode($clustername) . "&r=" . $v . "&cs=&ce='>$v</a></li>";
    $graph_args = "h=".rawurlencode($hostname)."&c=".rawurlencode($clustername)."&r=".rawurlencode($range);
    $host_file = $conf['conf_dir'] . "/host_" . preg_replace('/[^a-zA-Z0-9_-]/', '', $hostname) . ".json";
    if ( pathinfo( $host_file, PATHINFO_DIRNAME ) != $conf['conf_dir'] ) {
      die('Invalid path detected');
    }
	<IMG BORDER=0 ALT=\"".rawurlencode($clustername)."\" SRC=\"./graph.php?$graph_args&amp;g=" . $report_name ."&amp;z=mobile\"></A>";
    $metric_graphargs = "c=".rawurlencode($clustername)."&amp;h=".rawurlencode($hostname)."&amp;v=".rawurlencode($metric_attributes[VAL])
      ."&amp;m=$metric_name&amp;r=".rawurlencode($range)."&amp;z=$size&amp;jr=$jobrange"
	<IMG BORDER=0 ALT=\"".htmlspecialchars($clustername)."\" SRC=\"./graph.php?" . $g_metrics[$metric_name]['graph'] . "\"></A>";
    $graph_args[] = rawurlencode($key) . "=" . rawurlencode( str_replace("_/graph_php?", "", $value) );
$query_string = preg_replace("/(&trendhistory=)(\d+)/", "", htmlspecialchars($query_string, ENT_QUOTES) );
</script>
$base = isset($_GET['base']) ? rawurlencode($_GET['base']) . "/" : "";
	$range_args .= "&amp;r=" . rawurlencode($_GET['r']);
	$range_args .= "&amp;cs=" . rawurlencode($_GET['cs']) . "&amp;ce=" . rawurlencode($_GET['ce']);
          $base = isset($_GET['base']) ? rawurlencode($_GET['base']) : '.';
      $view_filename = $conf['views_dir'] . "/view_" . preg_replace('/[^a-zA-Z0-9_-]/', '', $view_suffix) . ".json";
      if ( pathinfo( $view_filename, PATHINFO_DIRNAME ) != $conf['views_dir'] ) {
        die('Invalid path detected');
      }
                  " Can't write to file " . htmlspecialchars($view_filename) .
      $view_filename = $conf['views_dir'] . "/view_" . preg_replace('/[^a-zA-Z0-9_-]/', '', $view_suffix) . ".json";
      if ( pathinfo( $view_filename, PATHINFO_DIRNAME ) != $conf['views_dir'] ) {
        die('Invalid path detected');
      }