Security Advisories (10)
CVE-2022-24785 (2022-04-04)

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

CVE-2020-11022 (2020-04-29)

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-11023 (2020-04-29)

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-11358 (2019-04-20)

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVE-2015-9251 (2018-01-18)

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVE-2011-4969 (2013-03-08)

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

CVE-2012-6708 (2018-01-18)

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

CVE-2020-7656 (2020-05-19)

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

CVE-2019-5428

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

CVE-2014-6071 (2018-01-16)

jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.

NAME

App::Netdisco - An open source web-based network management tool.

DESCRIPTION

Netdisco is a web-based network management tool designed for network administrators. Data is collected into a PostgreSQL database using SNMP.

Some of the things you can do with Netdisco:

  • Locate a machine on the network by MAC or IP and show the switch port it lives at

  • Turn off a switch port, or change the VLAN or PoE status of a port

  • Inventory your network hardware by model, vendor, software and operating system

  • Pretty pictures of your network

App::Netdisco provides a web frontend with built-in web server, and a backend daemon to gather information from your network, and handle interactive requests such as changing port or device properties.

We have several other pages with tips for installation tips, understanding and troubleshooting Netdisco, notes for specific device vendors, and all the configuration options.

You can also speak to someone in the #netdisco@freenode IRC channel, or on the community email list. Before installing or upgrading please always review the latest Release Notes.

Dependencies

Netdisco has several Perl library dependencies which will be automatically installed. However it's required that you first install the following operating system packages, if not the installation will most likely fail further down the road.

On Ubuntu/Debian:

root:~# apt-get install libdbd-pg-perl libsnmp-perl libssl-dev libio-socket-ssl-perl curl postgresql build-essential

On Fedora/Red-Hat:

root:~# yum install perl-core perl-DBD-Pg net-snmp-perl net-snmp-devel openssl-devel curl postgresql-server postgresql-contrib make automake gcc
root:~# postgresql-setup initdb
root:~# systemctl start postgresql
root:~# systemctl enable postgresql

On openSUSE:

root:~# zypper refresh
root:~# zypper install curl automake gcc make postgresql postgresql-server openssh openssl net-snmp perl perl-DBD-Pg perl-SNMP

On BSD systems please see our BSD tips.

With those installed, please check that your system's clock is correct.

Create a user on your system called netdisco if one does not already exist. We'll install Netdisco and its dependencies into this user's home area, which will take about 250MB including MIB files.

root:~# useradd -m -p x -s /bin/bash netdisco

Netdisco uses the PostgreSQL database server. Install PostgreSQL (at least version 9.4) and then change to the PostgreSQL superuser (usually postgres). Create a new database and PostgreSQL user for the Netdisco application:

root:~# su - postgres
 
postgres:~$ createuser -DRSP netdisco
Enter password for new role:
Enter it again:
 
postgres:~$ createdb -O netdisco netdisco

You may wish to amend the PostgreSQL configuration so that local connections are working. The default PostgreSQL configuration can also use tuning for modern server hardware. We recommend that you use one of the following tools to tune your postgresql.conf file:

postgresqltuner

Script that will check your operating system resources and settings as well as your running PostgreSQL database and will make recommendations based on actual load. Works on new netdisco installs but will make the best suggestions once the database contains a bigger dataset.

pgtune (fork)

A web based application which will recommend which parameters to change.

pgtune

Program to auto-tune your postgresql.conf, regretfully not updated in a while.

Installation

The following is a general guide which works well in most circumstances. It assumes you have a user netdisco on your system, that you want to perform an on-line installation, and have the application run self-contained from within that user's home. There are alternatives: see the Deployment documentation for further details.

To avoid muddying your system, use the following script to download and install Netdisco and its dependencies into the netdisco user's home area (~/perl5):

su - netdisco
curl -L https://cpanmin.us/ | perl - --notest --local-lib ~/perl5 App::Netdisco

Link some of the newly installed apps into a handy location:

mkdir ~/bin
ln -s ~/perl5/bin/{localenv,netdisco-*} ~/bin/

Test the installation by running the following command, which should only produce a status message (it's just a test - you'll start the daemons properly, later on):

~/bin/netdisco-backend status

Configuration

Make a directory for your local configuration and copy the configuration template from this distribution:

mkdir ~/environments
cp ~/perl5/lib/perl5/auto/share/dist/App-Netdisco/environments/deployment.yml ~/environments
chmod 600 ~/environments/deployment.yml

Edit the file ("~/environments/deployment.yml") and change the database connection parameters to match those for your local system (that is, the name, user and pass).

In the same file uncomment and edit the domain_suffix setting to be appropriate for your local site. Change the community string setting if your site has different values.

Have a quick read of the other settings to make sure you're happy, then move on. See Configuration for further details.

Initialisation

The database either needs configuring if new, or updating from the current release of Netdisco (1.x). You also need vendor MAC address prefixes (OUI data) and some MIBs if you want to run the backend daemon. The following script will take care of all this for you:

~/bin/netdisco-deploy

If this is a new installation of Netdisco 2, answer yes to all questions. If you wish to deploy without Internet access, see the Deployment documentation.

Startup

Run the following command to start the web-app server as a background process:

~/bin/netdisco-web start

The web app listens on port 5000 (for example http://localhost:5000/ or http://yourhost.example.com:5000/).

Run the following command to start the job control daemon (device polling, port control, etc):

~/bin/netdisco-backend start

First Run

After installing Netdisco for the first time, you must manually discover at least one device on your network. Choose a device which speaks CDP, FDP, or LLDP and knows about its neighbors; Netdisco will then start following this chain of neighbors to discover the rest of your network.

Either go to the web interface and enter an IP or fully qualified domain name, OR perform the following step at the command line:

~/bin/netdisco-do discover -d {name or IP address of a switch or router}

Further Reading

We have several pages with tips for alternate deployment scenarios, understanding and troubleshooting Netdisco, tips and tricks for specific platforms, and all the configuration options.

You can also speak to someone in the #netdisco@freenode IRC channel, or on the community email list. Before installing or upgrading please always review the latest Release Notes.

Upgrading from 2.x

Always review the latest Release Notes. Then the process below should be run for each installation:

# upgrade Netdisco
~/bin/localenv cpanm --notest App::Netdisco
ln -sf ~/perl5/bin/{localenv,netdisco-*} ~/bin/

# apply database schema updates, update MIBs and Vendor MACs
~/bin/netdisco-deploy

# restart web service (if you run it)
~/bin/netdisco-web restart

# restart the backend workers (wherever you run them)
~/bin/netdisco-backend restart

Furthermore, whenever you upgrade your Operating System, you must delete the ~/perl5 directory and re-run the following command, to update Netdisco's C library bindings:

curl -L https://cpanmin.us/ | perl - --notest --local-lib ~/perl5 App::Netdisco

Tips and Tricks

Searching

The main black navigation bar has a search box which is smart enough to work out what you're looking for in most cases. For example device names, node IP or MAC addresses, VLAN numbers, and so on.

Command-Line Device and Port Actions

Most significant Device jobs and Port actions, as well as several troubleshooting and housekeeping duties, can be performed at the command-line with the netdisco-do program. For example:

~/bin/netdisco-do -D discover -d 192.0.2.1

See the netdisco-do documentation for further details.

Import Topology

Netdisco 1.x had support for a topology information file to fill in device port relations which could not be discovered. This is now stored in the database (and edited in the web interface). To import a legacy topology file, run:

~/bin/localenv nd-import-topology /path/to/netdisco-topology.txt

Database API

Bundled with this distribution is a DBIx::Class layer for the Netdisco database. This abstracts away all the SQL into an elegant, re-usable OO interface. See the Developer documentation for further information.

Plugins

Netdisco includes a Plugin subsystem for customizing the web user interface and backend daemon. See Web Plugins and Backend Plugins for further information.

Extensions

Using the Plugins mechanism, it's also easy to write new commands (or actions) for Netdisco. For example, an action has been added to generate RANCID configuration.

Developing

Lots of information about the architecture of this application is contained within the Developer documentation.

AUTHOR

Oliver Gorwits <oliver@cpan.org>

CONTRIBUTORS

Netdisco was created at the University of California, Santa Cruz (UCSC), Networking and Technology Services (NTS) department. UCSC continues to support the development of Netdisco by providing development servers and beer.

Original development by Max Baker, with significant contributions from Mark Boolootian and Jim Warner (through whose ideas Netdisco was born and shaped), Bill Fenner, Jeroen van Ingen, Eric Miller, Carlos Vicente, and Brian de Wolf.

Other contributions (large and small) by Mike Hunter (UCB), Brian Wilson (NCSU), Bradley Baetz (bbaetz), David Temkin (sig.com), Edson Manners (FSU), Dmitry Sergienko (Trifle Co, .ua), Remo Rickli (PSI, Switzerland), Jean-Philippe Luiggi (sagem.com), A.L.M Buxey (Loughborough University, UK), Kevin Cheek (UMICH), John Bigrow (bnl.gov), George Pavel (llnl.gov), Charles Goldsmith (wokka.org), Douglas M. McKeown (saintmarys.edu), Revital Shvarzman (York U, Ontario), Walter Gould (Auburn U), Lindsay Druet and Colin Palmer (U of Waikato, Hamilton NZ), Dusty Hall (Auburn U), Jon Monroe (center pointe), Alexander Barthel, Bill Anderson, Alexander Hartmaier (t-systems.at), Justin Hunter (Arizona State U), Jethro Binks (U of Strathclyde, Glasgow), Jordi Guijarro (UAB.es), Sam Stickland (spacething.org), Stefan Radman (CTBTO.org), Clint Wise, Max Kosmach, Bernhard Augenstein and Nick Nauwelaerts (aquafin.be).

We probably forgot some names - sorry about that :-(.

Deep gratitude also goes to the authors and communities of all the other software that Netdisco is built upon.

COPYRIGHT AND LICENSE

This software is copyright (c) 2011-2019 by The Netdisco Developer Team.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
    * Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.
    * Redistributions in binary form must reproduce the above copyright
      notice, this list of conditions and the following disclaimer in the
      documentation and/or other materials provided with the distribution.
    * Neither the name of the Netdisco Project nor the
      names of its contributors may be used to endorse or promote products
      derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE NETDISCO DEVELOPER TEAM BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.