Bug #16971
Updated by Jim Pingle 1 day ago
When Zeek is active, it records a variety of information in its logs, including the user agent string of HTTP requests to the web server on the firewall itself. The *Real Time Inspection* page at @zeek_alerts.php@ displays these logs by fetching log data using @zeek_alert_data.php@, which assembles them into an HTML table but does not encode the content.
If a user submits a request to the web server using a specially-crafted user agent string, that user agent could be displayed to an administrator monitoring the Zeek log files (e.g. @software.log@, @http.log@, etc.), leading to a potential XSS.
Example request:
<pre>
curl -k --user-agent "<iframe/onload=alert('ZeekXSS')>" http://192.168.1.1/thisdoesnotexist
</pre>
There are several other log-related bugs in the Zeek package which prevent the *Real Time Inspection* page from working properly on current Plus versions of the package.
Reported by: @lujiefsi