9.1

CVE-2021-4406

Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others

An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC


  *  go to the alert manager


  *  open the ITSM tab
  *  add a webhook with the URL/service token value 

'	-h	&&	id	|	tee	/tmp/ttttttddddssss	#' (whitespaces are tab characters)


  *  click add


  *  click apply


  *  create a test alert


  *  The test alert will run the command 

“id	|	tee	/tmp/ttttttddddssss” as root.


  *  after the test alert inspect 

/tmp/ttttttddddssss it'll contain the ids of the root user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Osnexus ≫ Quantastor Version < 6.0.0.355
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.78% 0.509
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
csirt@divd.nl 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://www.osnexus.com/products/software-defined-storage
Product
https://www.divd.nl/DIVD-2021-00020
https://csirt.divd.nl/DIVD-2021-00020/
https://csirt.divd.nl/CVE-2021-4406
Third Party Advisory
https://csirt.divd.nl/cves/CVE-2021-4406/