CVE-2021-42083: An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the…

PriorityP427medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.46%

36.5th percentile

An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC


* go to the alert manager


* open the ITSM tab
* add a webhook with the URL/service token value

' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)


* click add


* click apply


* create a test alert


* The test alert will run the command

“id | tee /tmp/ttttttddddssss” as root.


* after the test alert inspect

/tmp/ttttttddddssss it'll contain the ids of the root user.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
osnexus	quantastor	< 6.0.0.355	6.0.0.355

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.