CVE-2021-4406: An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the…

PriorityP340high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

0.78%

51.1th percentile

An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC


* go to the alert manager


* open the ITSM tab
* add a webhook with the URL/service token value

' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)


* click add


* click apply


* create a test alert


* The test alert will run the command

“id | tee /tmp/ttttttddddssss” as root.


* after the test alert inspect

/tmp/ttttttddddssss it'll contain the ids of the root user.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
osnexus	quantastor	< 6.0.0.355	6.0.0.355
osnexus	quantastor	<= 6.0.0.355	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.