Privilege Escalation Vulnerability in Sourcefire 3D Sensor and Defense Center 4.8.x
A privilege escalation vulnerability found in the Sensor and the DC web based management interfaces allows any local account to take over the appliances administrator role. While the 'user.cgi' PERL script correctly validates that incoming requests belong to an authenticated session, in such a case it also blindly grants read/write access to all accounts configuration with no regard for the role of the request's originator. Therefore a user with even the lowest level of access (ie. without any role configured) is able to promote himself as administrator and/or change others roles and account parameters at will. Depending of the role or roles initially configured for this user, access to the user management page may not be visible into the interface's layout however the underlying script itself is still reachable and can be invoked 'by hand'. A malicious operator named 'foobar' whose role has been restricted to 'Event analyst (read only)' can send a forged POST request to promote himself to administrator with full access into the management interface.
