EIQ-2022-0003

EIQ-2022-0003

N/A

Drop-down menus that render user-defined item names are vulnerable to stored XSS attacks

9 May 2022

3 - HIGH

N/A

2.12.0, 2.11.3, 2.10.5

Overview

Drop-down menus in the Intelligence Center (IC) that render user-defined item names are vulnerable to stored XSS (cross-site scripting) attacks An attacker can create an object on the IC and have the object’s name/title contain a malicious payload. When any user on the IC opens a drop-down menu that attempts to display the malicious object’s name/title, the payload is triggered.

Requirements

An attacker needs at least modify permissions for any object type that gets displayed in a drop-down menu in the IC UI. Known affected object types (not exhaustive):

• Entities

• Groups

• Taxonomies

• Incoming feeds

• Outgoing feeds

• Workspaces

• Datasets

• Policies

To replicate:

1. Create a user (user1) with at least modify taxonomies permissions.

2. Sign in as the user (user1).

3. Go to Data configuration > Taxonomies.

4. Select Create taxonomy (+) to create a new taxonomy, and name it "><img src=x onerror="alert(1)">.

To trigger:

1. Sign in as any user.

2. Go to Data configuration > Taxonomies

3. Select Create taxonomy (+).

4. In the Create taxnomy panel that opens, select the Parent drop-down menu to load a list of taxonomies, including the malicious taxonomy.

Drop-down menus in the IC UI now sanitize item names before displaying them.

2.11.2 and earlier.

N/A