Bug #17006
Updated by Jim Pingle 3 days ago
The Suricata Blocks page at @suricata_blocked.php@ does not encode rule descriptions or other block data before display. The rule descriptions can be supplied by custom rules or untrusted external sources which could contain a problematic payload potentially leading to XSS. For example: <pre> alert icmp any any -> any any (msg:"xss<img src=x onerror=alert(String.fromCharCode(88,83,83))>"; itype:8; sid:990064640; rev:1;) </pre> If the attacker then sends traffic matching the rule while Suricata is set to block, then the next admin to view the Blocks page would trigger an XSS. Reported by: @lujiefsi