CVE-2021-25931
📋 TL;DR
This CVE describes a Cross-Site Request Forgery (CSRF) vulnerability in OpenNMS Horizon and Meridian that allows attackers to trick administrators into granting ROLE_ADMIN privileges to normal users. The vulnerability affects OpenNMS Horizon versions 1.0-stable through 27.1.0-1 and OpenNMS Meridian versions 2015.1.0-1 through 2019.1.18-1 and 2020.1.0-1 through 2020.1.6-1.
💻 Affected Systems
- OpenNMS Horizon
- OpenNMS Meridian
📦 What is this software?
Horizon by Opennms
Meridian by Opennms
Meridian by Opennms
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the OpenNMS system, enabling complete system compromise, data manipulation, and further network exploitation.
Likely Case
Attackers elevate privileges for existing user accounts, gaining administrative control over the monitoring system.
If Mitigated
Attackers cannot exploit the vulnerability due to proper CSRF protections or network segmentation.
🎯 Exploit Status
Exploitation requires social engineering to trick an authenticated admin user into clicking a malicious link. The technical complexity of the exploit itself is low.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenNMS Horizon 27.1.1 and later; OpenNMS Meridian 2020.1.7 and later
Vendor Advisory: https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84
Restart Required: Yes
Instructions:
1. Backup your OpenNMS configuration and database. 2. Update to OpenNMS Horizon 27.1.1+ or OpenNMS Meridian 2020.1.7+. 3. Restart the OpenNMS service. 4. Verify the fix by checking the version and testing CSRF protection.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to the vulnerable endpoint manually if patching is not immediately possible.
Modify /opennms/admin/userGroupView/users/updateUser endpoint to include CSRF tokens
Network Segmentation
allRestrict access to OpenNMS admin interface to trusted networks only.
Configure firewall rules to limit access to OpenNMS admin port (8980 by default) to authorized IPs only
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OpenNMS admin interface from untrusted networks
- Use browser extensions that block CSRF attacks and educate administrators about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check OpenNMS version against affected ranges. If version is within affected range and CSRF protection is not implemented at /opennms/admin/userGroupView/users/updateUser, the system is vulnerable.Check Version:
opennms versionVerify Fix Applied:
Verify OpenNMS version is 27.1.1+ for Horizon or 2020.1.7+ for Meridian. Test that CSRF tokens are required for the updateUser endpoint.📡 Detection & Monitoring
Log Indicators:
- Unexpected user privilege escalation events
- Multiple failed login attempts followed by successful admin actions
- Requests to /opennms/admin/userGroupView/users/updateUser without CSRF tokens
Network Indicators:
- Unusual traffic patterns to OpenNMS admin interface from unexpected sources
- HTTP POST requests to updateUser endpoint without referrer validation
SIEM Query:
source="opennms" AND (event_type="user_privilege_change" OR url_path="/admin/userGroupView/users/updateUser")🔗 References
- https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84
- https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25931
- https://github.com/OpenNMS/opennms/commit/607151ea8f90212a3fb37c977fa57c7d58d26a84
- https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25931
