CVE-2021-4406: Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-10 · updated 2026-06-17
Weakness: CWE-77

Description

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.

Affected products

OSNEXUS QuantaStor: before 6.0.0.355 — fixed in 6.0.0.355

How to fix

Upgrade to a fixed version: OSNEXUS QuantaStor 6.0.0.355. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-4406 or the next vulnerability affects your stack