CVE-2021-42083
📋 TL;DR
This vulnerability in OSNexus QuantaStor allows authenticated attackers to create alerts with malicious webhook URLs that execute arbitrary commands as root when triggered. The stored XSS leads to remote command execution with the highest privileges. Only authenticated users can exploit this vulnerability.
💻 Affected Systems
- OSNexus QuantaStor
📦 What is this software?
Quantastor by Osnexus
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level command execution, allowing data theft, system modification, or deployment of persistent backdoors.
Likely Case
Authenticated malicious insider or compromised account executes commands to exfiltrate data, escalate privileges, or pivot to other systems.
If Mitigated
With proper authentication controls and input validation, exploitation requires valid credentials and malicious payloads would be blocked.
🎯 Exploit Status
Detailed proof-of-concept is publicly available showing exact steps to achieve command execution. Exploitation requires authenticated access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.2.28 and later
Vendor Advisory: https://www.osnexus.com/products/software-defined-storage
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Download and install QuantaStor version 6.0.2.28 or later from OSNexus. 3. Apply the update through the management interface or command line. 4. Restart the QuantaStor services or reboot the system.
🔧 Temporary Workarounds
Disable Alert Webhooks
linuxTemporarily disable or restrict webhook functionality in alert configurations
# Check current alert configurations
# Remove or disable webhook URLs from alert settings
Restrict Alert Manager Access
allLimit access to the alert management interface to only necessary administrators
# Configure firewall rules to restrict access
# Implement IP whitelisting for management interface
🧯 If You Can't Patch
- Implement strict input validation and sanitization for webhook URL fields
- Apply network segmentation to isolate QuantaStor management interfaces from general network access
🔍 How to Verify
Check if Vulnerable:
Check QuantaStor version via web interface or command line. Versions below 6.0.2.28 are vulnerable.Check Version:
qs --version or check version in web interface dashboardVerify Fix Applied:
Verify version is 6.0.2.28 or later and test that malicious webhook URLs are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual alert creation events
- Webhook URLs containing shell commands or special characters
- Root command execution from alert processes
Network Indicators:
- Outbound connections from alert processes to unexpected destinations
- Unusual traffic patterns from QuantaStor management interface
SIEM Query:
source="quantaStor" AND (event="alert_created" OR event="webhook_triggered") AND (url CONTAINS "&&" OR url CONTAINS "|" OR url CONTAINS "#")🔗 References
- https://csirt.divd.nl/CVE-2021-42083
- https://csirt.divd.nl/DIVD-2021-00020/
- https://www.osnexus.com/products/software-defined-storage
- https://www.wbsec.nl/osnexus
- https://csirt.divd.nl/CVE-2021-42083
- https://www.divd.nl/DIVD-2021-00020
- https://www.osnexus.com/products/software-defined-storage
- https://www.wbsec.nl/osnexus
