Local Router Identity Accesable via Router Console

[psi]

accessing the following url can obtain sensitive information

​http://127.0.0.1:7657/netdb?r=.

this can be exploited by xss to reveal a user's local identity to a remote attacker

[psi]

Replying to psi:

accessing the following url can obtain sensitive information

​http://127.0.0.1:7657/netdb?r=.

this can be exploited by xss to reveal a user's local identity to a remote attacker

​http://127.0.0.1:7657/netdb?r=%2E is the correct url

[zzz]

if that's the case, the user's IP is visible on several pages… /peers, /confignet, i2ptunnel, …

Is this realistic, given that browsers generally won't fetch from localhost?

If it is realistic, do you have a proposal for fixing it?

[zzz]

May or may not be related, but findbugs reports 13 possible XSS vulnerabilities in the JSPs, to be reviewed and fixed if real.

Using findbugs 2.0.3-rc1

[killyourtv]

Replying to zzz:

Using findbugs 2.0.3-rc1

I didn't know that was out but Jenkins will be using that too.

[zzz]

No reply from OP, no proposal posted.