CVE-2021-4406: Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others
An administrator is able to execute commands as root via the alerts management dialog
Other sources
An authenticated attacker is able to create alerts that trigger a stored XSS attack.
POC
go to the alert manager
open the ITSM tab add a webhook with the URL/service token value
' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)
click add
click apply
create a test alert
The test alert will run the command
“id | tee /tmp/ttttttddddssss” as root.
after the test alert inspect
/tmp/ttttttddddssss it'll contain the ids of the root user.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-4406?
CVE-2021-4406 is a vulnerability that allows an administrator to execute commands as root via the alerts management dialog.
What software is affected by CVE-2021-4406?
Quantastor version up to exclusive 6.0.0.355 is affected by CVE-2021-4406.
What is the severity of CVE-2021-4406?
CVE-2021-4406 has a severity level of high (7).
How can I fix CVE-2021-4406?
To fix CVE-2021-4406, update Quantastor to a version higher than 6.0.0.355.
Where can I find more information about CVE-2021-4406?
You can find more information about CVE-2021-4406 at the following references: [Link 1](https://www.divd.nl/DIVD-2021-00020), [Link 2](https://www.osnexus.com/products/software-defined-storage), [Link 3](https://csirt.divd.nl/CVE-2021-4406).