PT-2017-19317 · Osnexus · Quantastor

Nahuel D. Sanchez · Published 2017-08-28 · Updated 2024-02-14 · CVE-2017-9979

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OSNEXUS QuantaStor versions prior to 4.3.1

Description The issue allows an attacker to inject arbitrary HTML or JavaScript code as a parameter in a REST call, potentially leading to a cross-site scripting (XSS) attack. When an invalid REST call is invoked, the error response contains the previously invoked method, which is not sanitized. This lack of sanitization enables the inclusion of malicious code.

Recommendations For OSNEXUS QuantaStor versions prior to 4.3.1, update to version 4.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation. Avoid using parameters that could be used to inject malicious code in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9979

Affected Products

Quantastor

References · 6

• 🔥 http://packetstormsecurity.com/files/143780/OSNEXUS-QuantaStor-4-Information-Disclosure.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Aug/23 · Exploit
• 🔥 https://exploit-db.com/exploits/42517 · Exploit
• 🔥 http://vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9979 · Security Note
• https://osv.dev/vulnerability/CVE-2017-9979 · Vendor Advisory