CSRF and XSS vulnerabilities in server manager

On August 28 2017 23:55 UTC two vulnerabilities affecting the server manager (web management UI) of NethServer have been reported by Gjoko ‘LiquidWorm’ Krstic

Both NS 6 and NS 7 versions are affected.

I’m working on a fix for the UI framework, Nethgui. Further fixes to individual packages could be required, expecially for NS7.

You can mitigate the issue by executing the logoff immediately after using the Server Manager.
See also Personal Safety CSRF Tips for Users (owasp.org) for more best practices…

/cc @dev_team @quality_team


The fix is ready for testing! Packages are available for both ns6 and ns7 /cc @quality_team team


A new FileUpload Nethgui widget has been implemented to automatize CSRF token manipulations in HTML FORM tags. /cc @dev_team

This is an example of how to use the new FileUpload widget, substituting the previous workaround:



Thank You :slight_smile:

1 Like

All packages have been released.


This topic was automatically closed after 3 days. New replies are no longer allowed.