Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others

An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC

• go to the alert manager

• open the ITSM tab
• add a webhook with the URL/service token value

' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)

• click add

• click apply

• create a test alert

• The test alert will run the command

“id | tee /tmp/ttttttddddssss” as root.

• after the test alert inspect

/tmp/ttttttddddssss it'll contain the ids of the root user.