RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product:        AlienVault USM/OSSIM
Vendor URL:     www.alienvault.com
Type:           Cross-Site Scripting [CWE-79]
Date found:     2016-05-24
Date published: 2016-08-23
CVSSv3 Score:   5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVE:            CVE-2016-6913


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
AlienVault OSSIM 5.2
AlienVault USM 5.2
older versions may be affected too.


4. INTRODUCTION
===============
OSSIM, AlienVaultas Open Source Security Information and Event Management
(SIEM) product, provides you with a feature-rich open source SIEM complete
with event collection, normalization and correlation. Launched by security
engineers because of the lack of available open source products, OSSIM was
created specifically to address the reality many security professionals
face: A SIEM, whether it is open source or commercial, is virtually useless
without the basic security controls necessary for security visibility.

(from the vendor's homepage)


5. VULNERABILITY DETAILS
========================
The script "/ossim/conf/reload.php" is vulnerable to an authenticated
DOM-based Cross-Site Scripting vulnerability when user-supplied input to the
HTTP GET parameter "back" is processed by the web application. Since the
application does not properly validate and sanitize this parameter, it is
possible to place arbitrary script code in a document.location.href property
which could also be used to redirect a user.

The following Proof-of-Concept triggers this vulnerability:
https://127.0.0.1/ossim/conf/reload.php?what=policies&back=\%27;alert(/XSS/);//

The payload is used in a JavaScript, which is embedded within the
"/ossim/conf/reload.php" page:

<script type="text/javascript">
    $(document).ready(function(){
      if (typeof(top.refresh_notifications) == 'function')
      {
        top.refresh_notifications()
      }
           
     document.location.href = '\\';alert(/XSS/);//';
    });
</script>


6. RISK
=======
To successfully exploit this vulnerability an authenticated user must be
tricked into visiting an arbitrary website while having an authenticated
session in the application.

The vulnerability can be used to temporarily embed arbitrary script code
into the context of the AlienVault administrative interface, which offers a
wide range of possible attacks such as redirecting the user to a malicious
page or attacking the browser and its plugins.


7. SOLUTION
===========
Update to AlienVault OSSIM/USM 5.3


8. REPORT TIMELINE
==================
2016-05-24: Discovery of the vulnerability
2016-05-24: Notified vendor via public security mail address
2016-05-31: No response, sent out another notification
2016-06-03: Vendor evaluates the vulnerability information
2016-06-23: Vendor confirms the vulnerability
2016-07-12: Vendor sets release date of the fix to 2016-08-02
2016-07-22: CVE requested from MITRE
2016-08-02: Vendor releases advisory ENG-103709
2016-08-23: MITRE assigns CVE-2016-6913
2016-08-23: Advisory released


9. REFERENCES
=============
https://www.alienvault.com/forums/discussion/7558/