PT-2021-19666 · Unknown · Bloodhound

Magicozo · Published 2021-02-19 · Updated 2021-02-25 · CVE-2021-3210

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bloodhound versions 4.0.1 and earlier

Description: The issue allows remote attackers to execute arbitrary system commands when a victim imports a malicious data file containing JavaScript in the objectId parameter. This occurs in the components/Modals/HelpTexts/GenericAll/GenericAll.jsx file.

Recommendations: For Bloodhound versions 4.0.1 and earlier, update to a version later than 4.0.1 to resolve the issue. As a temporary workaround, consider restricting the import of data files to trusted sources and avoiding the use of the objectId parameter with untrusted input until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-3210

Affected Products

Bloodhound

References · 6

• 🔥 https://github.com/BloodHoundAD/BloodHound/blob/338e197dc4b7a1ee929c335141172ada5bc80800/src/components/Modals/HelpModal.jsx#L57 · Exploit
• 🔥 https://github.com/BloodHoundAD/BloodHound/blob/338e197dc4b7a1ee929c335141172ada5bc80800/src/components/Modals/HelpTexts/GenericAll/GenericAll.jsx#L31-L37 · Exploit
• 🔥 https://github.com/BloodHoundAD/BloodHound/issues/338 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-3210 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3210 · Vendor Advisory
• https://t.me/cibsecurity/23857 · Telegram Post