AlienVault OSSIM 4.3 CSRF vulnerability report Oct 25 2015 11:24PM
mohammadreza mohajerani gmail com
Dear Sir/Madam,
I would like to report a vulnerability in AlienVault OSSIM v4.3 products which led to CSRF attack
here is the news :

and here is the detail of attack:
# Exploit Title: [AlienVault - ossim CSRF]
# Date: [10-5-2015]
# Exploit Author: [MohamadReza Mohajerani]
# Vendor Homepage: [www.alienvault.com]
# Software Link: [https://www.alienvault.com/products/ossim]
# Version: [Tested on 4.3]

Vulnerability Details:


Multiple CSRF vectors exists within AlienVault ossim allowing the following

1)Delete user accounts(ex.admin account)

2)Delete knowledge DB items

Exploit code(s):


The only thing the attacker needs to do is sending the following link to
the victim via GET request , if the victim authenticated on the ossim and
click on the link the following attacks can be occurred :

1)For deleting the
knowledge DB items just send the link below:

[id_document is the item number which you want to delete (it starts from 1)]

2)For deleting the user accounts (ex.admin account) use the link below :

[the random number (1444042812845) is not important at all and you can
change the number to whatever you want]

Severity Level:


Yours Faithfully

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus