CVE-2016-6913 AlienVault USM/OSSIM 5.2 …

ADVISORY INFORMATION

Product: AlienVault USM/OSSIM
Vendor URL: https://www.alienvault.com
Type: Cross-Site Scripting [CWE-79]
Date found: 2016-05-24
Date published: 2016-08-23
CVSSv3 Score: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVE: CVE-2016-6913

CREDITS

This vulnerability was discovered and researched by Julien Ahrens from RCE Security.

VERSIONS AFFECTED

AlienVault OSSIM 5.2 AlienVault USM 5.2 older versions may be affected too.

INTRODUCTION

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides you with a feature-rich open source SIEM complete with event collection, normalization and correlation. Launched by security engineers because of the lack of available open source products, OSSIM was created specifically to address the reality many security professionals face: A SIEM, whether it is open source or commercial, is virtually useless without the basic security controls necessary for security visibility.

(from the vendor’s homepage)

VULNERABILITY DETAILS

The script “/ossim/conf/reload.php” is vulnerable to an authenticated DOM-based Cross-Site Scripting vulnerability when user-supplied input to the HTTP GET parameter “back” is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code in a document.location.href property which could also be used to redirect a user.

The following Proof-of-Concept triggers this vulnerability: https://127.0.0.1/ossim/conf/reload.php?what=policies&back=%27;alert(/XSS/);//

The payload is used in a JavaScript, which is embedded within the “/ossim/conf/reload.php” page:

<script type="text/javascript">
    $(document).ready(function(){
      if (typeof(top.refresh_notifications) == 'function')
      {
        top.refresh_notifications()
      }
     document.location.href = '\\';alert(/XSS/);//';
    });
</script>

RISK

To successfully exploit this vulnerability an authenticated user must be tricked into visiting an arbitrary website while having an authenticated session in the application.

The vulnerability can be used to temporarily embed arbitrary script code into the context of the AlienVault administrative interface, which offers a wide range of possible attacks such as redirecting the user to a malicious page or attacking the browser and its plugins.

SOLUTION

Update to AlienVault OSSIM/USM 5.3

REPORT TIMELINE

2016-05-24: Discovery of the vulnerability
2016-05-24: Notified vendor via public security mail address
2016-05-31: No response, sent out another notification
2016-06-03: Vendor evaluates the vulnerability information
2016-06-23: Vendor confirms the vulnerability
2016-07-12: Vendor sets release date of the fix to 2016-08-02
2016-07-22: CVE requested from MITRE
2016-08-02: Vendor releases advisory ENG-103709
2016-08-23: MITRE assigns CVE-2016-6913
2016-08-23: Advisory released

AlienVault USM/OSSIM 5.2 conf/reload.php "back" DOM-based Cross-Site Scripting