PT-2023-22535 · Open Networking Foundation · Onos

Published 2023-05-04 · Updated 2023-05-12 · CVE-2023-30093

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open Networking Foundation ONOS versions 1.9.0 through 2.7.0

Description A cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter or authorizationURL parameter of the API documentation dashboard. An arbitrary file upload vulnerability also allows attackers to execute arbitrary code via uploading a crafted YAML file.

Recommendations For Open Networking Foundation ONOS versions 1.9.0 through 2.7.0, consider disabling access to the API documentation dashboard until a patch is available. Restrict the use of the url parameter and authorizationURL parameter to minimize the risk of exploitation. Avoid uploading YAML files from untrusted sources to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-30093

GHSA-Q63Q-HWF6-3MW6

Affected Products

Onos

References · 8

• 🔥 https://edoardoottavianelli.it/CVE-2023-30093 · Exploit
• 🔥 https://youtube.com/watch?v=jZr2JhDd_S8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-30093 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30093 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q63q-hwf6-3mw6 · Vendor Advisory
• https://github.com/opennetworkinglab/onos · Note
• https://t.me/cvenotify/50242 · Telegram Post
• https://t.me/cibsecurity/63341 · Telegram Post