CVE-2021-42081
📋 TL;DR
This vulnerability allows authenticated administrators to execute arbitrary shell commands through the API in OSNexus QuantaStor storage systems. Attackers with admin credentials can achieve remote code execution, potentially compromising the entire storage system. Organizations using affected OSNexus QuantaStor versions are at risk.
💻 Affected Systems
- OSNexus QuantaStor
📦 What is this software?
Quantastor by Osnexus
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing data theft, destruction, or ransomware deployment across the storage infrastructure.
Likely Case
Unauthorized data access, system configuration changes, or lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation and admin credential protection are in place.
🎯 Exploit Status
Simple command injection via API parameters with documented proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7.2 and later
Vendor Advisory: https://www.osnexus.com/products/software-defined-storage
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Download QuantaStor 5.7.2 or later from OSNexus. 3. Apply update via web interface or CLI. 4. Restart services or system as required.
🔧 Temporary Workarounds
API Access Restriction
linuxRestrict network access to the QuantaStor API interface.
iptables -A INPUT -p tcp --dport 443 -s trusted_networks -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Admin Credential Rotation
allChange all admin passwords and implement strong authentication.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate QuantaStor systems from critical networks.
- Enable detailed API logging and monitor for suspicious command injection patterns.
🔍 How to Verify
Check if Vulnerable:
Check QuantaStor version via web interface or 'qs --version' command. Versions below 5.7.2 are vulnerable.Check Version:
qs --versionVerify Fix Applied:
Confirm version is 5.7.2 or higher and test API endpoints for command injection using safe test commands.📡 Detection & Monitoring
Log Indicators:
- Unusual API requests with shell metacharacters (;, $, |) in parameters
- Multiple failed admin login attempts followed by API access
Network Indicators:
- HTTP requests to /qstorapi/storageSystemModify with suspicious parameters
- Outbound connections from QuantaStor to unexpected destinations
SIEM Query:
source="quanta.log" AND (uri_path="/qstorapi/storageSystemModify" AND (param="newDescription" OR param="newDnsServerList" OR param="newNTPServerList") AND param_value MATCHES "[;|$`]" )🔗 References
- https://csirt.divd.nl/CVE-2021-42081
- https://csirt.divd.nl/DIVD-2021-00020/
- https://www.osnexus.com/products/software-defined-storage
- https://www.wbsec.nl/osnexus
- https://csirt.divd.nl/CVE-2021-42081
- https://www.divd.nl/DIVD-2021-00020
- https://www.osnexus.com/products/software-defined-storage
- https://www.wbsec.nl/osnexus
