🔐 Access Requirements

• Authentication: Yes
• Privileges: Any user with access to rule creation/editing

⚙️ Technical Details

• Vulnerability Type: Stored Cross-site Scripting (XSS)
• Vector: Web UI → Rule Wizard
• Injection Point: Regular Expression field
• Persistence: Stored in configuration and triggered on view
• Security Misstep: Improper input sanitization and reflection in HTML context

⚠️ Impact

This XSS vulnerability allows an attacker to:

• Execute arbitrary JavaScript in another user’s browser session
• Perform session hijacking or token theft
• Steal sensitive data from authenticated users
• Impersonate users or elevate privileges (if privileged users trigger the payload)
• Redirect victims to phishing or malicious domains

🧪 Exploitation Notes

• Exploitation is non-trivial, requiring an attacker to inject the payload and a victim to interact with the infected rule interface.
• The attack does not require social engineering if users frequently interact with saved rules.

🏁 Timeline

📄 Disclaimer

This research was conducted under ethical guidelines and in a responsible disclosure process. No production systems were harmed. This publication is for educational and defensive purposes only.

👤 Author

Rodrigo Hormazábal
Security Researcher — SOAR & SIEM Automation
🔗 LinkedIn
🧑‍💻 GitHub
🐙 HackerOne