AlienVault USM/OSSIM 5.2 Cross Site Scripting

`RCE Security Advisory  
https://www.rcesecurity.com  
  
  
1. ADVISORY INFORMATION  
=======================  
Product: AlienVault USM/OSSIM  
Vendor URL: www.alienvault.com  
Type: Cross-Site Scripting [CWE-79]  
Date found: 2016-05-24  
Date published: 2016-08-23  
CVSSv3 Score: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)  
CVE: CVE-2016-6913  
  
  
2. CREDITS  
==========  
This vulnerability was discovered and researched by Julien Ahrens from  
RCE Security.  
  
  
3. VERSIONS AFFECTED  
====================  
AlienVault OSSIM 5.2  
AlienVault USM 5.2  
older versions may be affected too.  
  
  
4. INTRODUCTION  
===============  
OSSIM, AlienVaultas Open Source Security Information and Event Management  
(SIEM) product, provides you with a feature-rich open source SIEM complete  
with event collection, normalization and correlation. Launched by security  
engineers because of the lack of available open source products, OSSIM was  
created specifically to address the reality many security professionals  
face: A SIEM, whether it is open source or commercial, is virtually useless  
without the basic security controls necessary for security visibility.  
  
(from the vendor's homepage)  
  
  
5. VULNERABILITY DETAILS  
========================  
The script "/ossim/conf/reload.php" is vulnerable to an authenticated  
DOM-based Cross-Site Scripting vulnerability when user-supplied input to the  
HTTP GET parameter "back" is processed by the web application. Since the  
application does not properly validate and sanitize this parameter, it is  
possible to place arbitrary script code in a document.location.href property  
which could also be used to redirect a user.  
  
The following Proof-of-Concept triggers this vulnerability:  
https://127.0.0.1/ossim/conf/reload.php?what=policies&back=\%27;alert(/XSS/);//  
  
The payload is used in a JavaScript, which is embedded within the  
"/ossim/conf/reload.php" page:  
  
<script type="text/javascript">  
$(document).ready(function(){  
if (typeof(top.refresh_notifications) == 'function')  
{  
top.refresh_notifications()  
}  
  
document.location.href = '\\';alert(/XSS/);//';  
});  
</script>  
  
  
6. RISK  
=======  
To successfully exploit this vulnerability an authenticated user must be  
tricked into visiting an arbitrary website while having an authenticated  
session in the application.  
  
The vulnerability can be used to temporarily embed arbitrary script code  
into the context of the AlienVault administrative interface, which offers a  
wide range of possible attacks such as redirecting the user to a malicious  
page or attacking the browser and its plugins.  
  
  
7. SOLUTION  
===========  
Update to AlienVault OSSIM/USM 5.3  
  
  
8. REPORT TIMELINE  
==================  
2016-05-24: Discovery of the vulnerability  
2016-05-24: Notified vendor via public security mail address  
2016-05-31: No response, sent out another notification  
2016-06-03: Vendor evaluates the vulnerability information  
2016-06-23: Vendor confirms the vulnerability  
2016-07-12: Vendor sets release date of the fix to 2016-08-02  
2016-07-22: CVE requested from MITRE  
2016-08-02: Vendor releases advisory ENG-103709  
2016-08-23: MITRE assigns CVE-2016-6913  
2016-08-23: Advisory released  
  
  
9. REFERENCES  
=============  
https://www.alienvault.com/forums/discussion/7558/  
  
`