A vulnerability was found in Tripwire Enterprise 7.0/8.2. It has been rated as problematic. This issue affects an unknown function of the file ajaxRequest/methodCall.do. The manipulation of the argument m_target_class_name with an unknown input leads to a cross site scripting vulnerability (Reflected). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Multiple cross-site scripting (XSS) vulnerabilities in ajaxRequest/methodCall.do in Tripwire Enterprise 8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) m_target_class_name, (2) m_target_method_name, or (3) m_request_context_params parameters.

The weakness was released 09/12/2013 by Roger Sels with ZeroDayLab as 2013-5005 as confirmed advisory (Website). It is possible to read the advisory at zerodaylab.com. The identification of this vulnerability is CVE-2013-5005 since 07/29/2013. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

A public exploit has been developed by Roger Sels in HTTP Request and been published immediately after the advisory. The exploit is available at zerodaylab.com. It is declared as proof-of-concept. The advisory illustrates:

Injecting in the afore-mentioned parameters will throw an exception (along with an HTTP/403 Forbidden error message from the server). The output of the exception is not sanitised properly and the javascript code is executed. (…) The original requests used the POST method, however it was possible to convert the requests to use the GET method, to enable easier demonstration and delivery of the attack.

Upgrading to version 8.3 eliminates this vulnerability. The upgrade is hosted for download at tripwire.com. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at X-Force (90950), SecurityFocus (BID 65242†) and OSVDB (102682†).

Productinfo

Vendor

• Tripwire

Name

• Enterprise

Version

• 7.0
• 8.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion