Project

General

Profile

Actions
Copy link

Bug #17015

open

Potential XSS via rule descriptions in the Snort Alerts Dashboard Widget

Added by Jim Pingle 2 days ago. Updated 2 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Jim Pingle
Category:
Snort
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

The Snort Alerts Dashboard widget (snort_alerts.widget.php, snort_alerts.js) does not encode rule descriptions or other data before display.

The rule descriptions can be supplied by custom rules or untrusted external sources which could contain a problematic payload, potentially leading to XSS.

For example:

alert icmp any any -> any any (msg:"xss<img src=x onerror=alert(String.fromCharCode(88,83,83))>"; itype:8; sid:990064640; rev:1;)

If the attacker then sends traffic matching the rule while Snort is set to alert and the Snort Dashboard Widget is active, then the next administrator to view the Dashboard page would trigger an XSS.

Reported by: @lujiefsi

Actions
Copy link

Also available in: Atom