Project

General

Profile

Actions
Copy link

Bug #17017

open

Potential XSS via rule descriptions in the Snort Rules page

Added by Jim Pingle 2 days ago. Updated 2 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Jim Pingle
Category:
Snort
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

The Snort Rules page (snort_rules.php) does not encode rule descriptions or other data before display.

The rule descriptions can be supplied by custom rules or untrusted external sources which could contain a problematic payload, potentially leading to XSS.

For example:

alert icmp any any -> any any (msg:"xss<img src=x onerror=alert(String.fromCharCode(88,83,83))>"; itype:8; sid:990064640; rev:1;)

If the administrator views the snort_rules.php page with a Category that renders the rules table such as "Active Rules" containing one of these entries, it can trigger an XSS.

Reported by: @lujiefsi

Actions
Copy link
 #1

Updated by Jim Pingle 2 days ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100
  • Private changed from Yes to No

Fixed in Snort pkg v4.1.10

Actions
Copy link

Also available in: Atom