bugtraq - AlienVault OSSIM 4.3 CSRF vulnerability report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201510252324.t9PNOKdk010499@sf01web2.securityfocus.com>
Date: Sun, 25 Oct 2015 23:24:20 GMT
From: mohammadreza.mohajerani@...il.com
To: bugtraq@...urityfocus.com
Subject: AlienVault OSSIM 4.3 CSRF vulnerability report

Dear Sir/Madam,
I would like to report a vulnerability in AlienVault OSSIM v4.3 products which led to CSRF attack 
here is the news :
1)https://packetstormsecurity.com/files/134060/alienvaultossim-xsrf.txt
2)https://www.exploit-db.com/exploits/38400/

and here is the detail of attack:
# Exploit Title: [AlienVault - ossim CSRF]
# Date: [10-5-2015]
# Exploit Author: [MohamadReza Mohajerani]
# Vendor Homepage: [www.alienvault.com]
# Software Link: [https://www.alienvault.com/products/ossim]
# Version: [Tested on 4.3]
 
Vulnerability Details:
 
=====================
 
 
Multiple CSRF vectors exists within AlienVault ossim allowing the following
attacks:
 
1)Delete user accounts(ex.admin account)
 
2)Delete knowledge DB items
 
Exploit code(s):
 
===============
 
The only thing the attacker needs to do is sending the following link to
the victim via GET request , if the victim authenticated on the ossim and
click on the link the following attacks can be occurred :
 
1)For deleting the
knowledge DB items just send the link below:
https://ossim-ip/ossim/repository/repository_delete.php?id_document=10232
 
 
[id_document is the item number which you want to delete (it starts from 1)]
 
2)For deleting the user accounts (ex.admin account) use the link below :
https://ossim-ip/ossim/session/deleteuser.php?user=admin&_=1444042812845
 
[the random number (1444042812845) is not important at all and you can
change the number to whatever you want]
 
 
 
Severity Level:
 
================
High


Yours Faithfully