LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.
Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."
Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscript, allows local users to gain privileges via a Trojan horse .egg-info file in the (1) current working directory or (2) its parent directories.
Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration.
Various components in the /luci/homebase and /luci/cluster menu, which should be restricted to administrative users only, are exposed to any logged-in (non-administrative, but authenticated) user if visited with a specially constructed URL. This could allow an authenticated, non-administrative, user to, among others: add new users, add systems, remove clusters from conga, and view logs.
This particular issue affects luci, as included in conga, and does not affect luci otherwise.
Acknowledgements:
This issue was discovered by Radek Steiger of Red Hat.
It was reported that Luci's (Luci is a web based front-end component of the Conga cluster management system) user session timeout feature depended only on JavaScript script running in the user's browser. If user closed browser tab without logging out of Luci session and without closing browser, they could re-open Luci web interface and continue using the session even after the timeout period has elapsed.
References: http://sourceware.org/cluster/conga/
Acknowledgement:
Red Hat would like to thank George Hedfors of Cybercom Sweden East AB for reporting this issue.