SNS Vulnerability

OSSIM Cross-Site Scripting and SQL Injection Vulnerabilities

Description

Multiple vulnerabilities have been discovered in OSSIM, which can be exploited by malicious people to conduct cross-site scripting and SQL injection attacks.
1) Input passed via the "scan_server" and "targets" GET parameters to ossim/vulnmeter/simulate.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Input passed via the "date_from" GET parameter to multiple scripts is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
List of affected scripts:
<a href="http://[host]/RadarReport/radar-iso27001-potential.php
" target="_blank">http://[host]/RadarReport/radar-iso27001-potential.php
</a>
<a href="http://[host]/RadarReport/radar-iso27001-A12IS_acquisition-pot.php
" target="_blank">http://[host]/RadarReport/radar-...1-A12IS_acquisition-pot.php
</a>
<a href="http://[host]/RadarReport/radar-iso27001-A11AccessControl-pot.php
" target="_blank">http://[host]/RadarReport/radar-...01-A11AccessControl-pot.php
</a>
<a href="http://[host]/RadarReport/radar-iso27001-A10Com_OP_Mgnt-pot.php
" target="_blank">http://[host]/RadarReport/radar-...7001-A10Com_OP_Mgnt-pot.php
</a>
<a href="http://[host]/RadarReport/radar-pci-potential.php
" target="_blank">http://[host]/RadarReport/radar-pci-potential.php
</a>
The vulnerabilities are confirmed in version 4.3.0. Other versions may also be affected.

Vulnerable Products

Vulnerable Software:
OSSIM (AlienVault Open Source SIM) 4.x

Solution

Update to version 4.3.3.

CVE

CVE-2013-5967

References

xistence:
http://packetstormsecurity.com/files/122547/Alienvault-OSSIM-Cross-Site-Scripting.html
Yu-Chi Ding:
http://osvdb.org/ref/97/ossim-sql.txt

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious tag with event found in data	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	3.2.0
XSS - Prevention - POST : 'location' javascript object found in data	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - POST : javascript code found in data	3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
XSS - Prevention - POST : code allowing cookie access found in data	3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - POST : 'script' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	5.0.0
XSS - Prevention - POST : javascript code found in data	5.0.0
XSS - Prevention - POST : suspicious tag with event found in data	5.0.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	5.0.0
XSS - Prevention - POST : 'location' javascript object found in data	5.0.0
XSS - Prevention - POST : code allowing cookie access found in data	5.0.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0
XSS - Prevention - POST : 'script' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'div' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	5.0.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'object' tag found in data	5.0.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	5.0.0

Risk level

Moderate

Vulnerability First Public Report Date

2013-07-29

Target Type

Server

Possible exploit

Remote