Actions
Bug #17007
open
Potential XSS via rule descriptions in the Suricata Alerts Dashboard Widget
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
The Suricata Alerts Dashboard widget (suricata_alerts.widget.php, suricata_alerts.js) does not encode rule descriptions or other data before display.
The rule descriptions can be supplied by custom rules or untrusted external sources which could contain a problematic payload, potentially leading to XSS.
For example:
alert icmp any any -> any any (msg:"xss<img src=x onerror=alert(String.fromCharCode(88,83,83))>"; itype:8; sid:990064640; rev:1;)
If the attacker then sends traffic matching the rule while Suricata is set to alert and the Suricata Dashboard Widget is active, then the next administrator to view the Dashboard page would trigger an XSS.
Reported by: @lujiefsi
Updated by Jim Pingle 2 days ago
- Status changed from Confirmed to Feedback
- % Done changed from 0 to 100
- Private changed from Yes to No
Fixed in Suricata pkg v7.0.9
Actions
Also available in: Atom