Bug #17007
Updated by Jim Pingle 3 days ago
The Suricata Alerts Dashboard widget (@suricata_alerts.widget.php@, @suricata_alerts.js@) does not encode rule descriptions or other data before display. The rule descriptions can be supplied by custom rules or untrusted external sources which could contain a problematic payload, potentially leading to XSS. For example: <pre> alert icmp any any -> any any (msg:"xss<img src=x onerror=alert(String.fromCharCode(88,83,83))>"; itype:8; sid:990064640; rev:1;) </pre> If the attacker then sends traffic matching the rule while Suricata is set to alert and the Suricata Dashboard Widget is active, then the next administrator to view the Dashboard page would trigger an XSS. Reported by: @lujiefsi