Project

General

Profile

Actions
Copy link

Bug #17007

closed
JP JP

Potential XSS via rule descriptions in the Suricata Alerts Dashboard Widget

Bug #17007: Potential XSS via rule descriptions in the Suricata Alerts Dashboard Widget

Added by Jim Pingle about 1 month ago. Updated 28 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Suricata
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

The Suricata Alerts Dashboard widget (suricata_alerts.widget.php, suricata_alerts.js) does not encode rule descriptions or other data before display.

The rule descriptions can be supplied by custom rules or untrusted external sources which could contain a problematic payload, potentially leading to XSS.

For example:

alert icmp any any -> any any (msg:"xss<img src=x onerror=alert(String.fromCharCode(88,83,83))>"; itype:8; sid:990064640; rev:1;)

If the attacker then sends traffic matching the rule while Suricata is set to alert and the Suricata Dashboard Widget is active, then the next administrator to view the Dashboard page would trigger an XSS.

Reported by: @lujiefsi

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #1

  • Description updated (diff)

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #2

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100
  • Private changed from Yes to No

Fixed in Suricata pkg v7.0.9

GT Updated by Georgiy Tyutyunnik 28 days ago Actions
Copy link
 #3

  • Status changed from Feedback to Resolved

Fixed in Suricata pkg v7.0.9, available in 26.03.1 and 26.07

Actions
Copy link

Also available in: Atom