Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Reflected XSS reported 2021-03-31 (update summary after disclosure)

Description

The reporter of this vulnerability prefers to remain anonymous.

A reflected cross-site scripting (XSS) vulnerability exists in the OpenNMS webapp, and can be exploited by any actor with the ability to search for events in the webapp. I have verified that it is exploitable in Horizon 27.1.0.

Steps to reproduce:

  1. Log in as a normal, non-admin user

  2. Open Status -> Events

  3. In the "Event ID" box, enter <script>alert("XSS")</script> and submit the form

Expected result: Input validation neutralizes the attempted exploit, as already happens when searching for alarms and notifications
Actual result: Alert popup observed in empty search results page

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Show:

Jeff Gehlbach August 6, 2021 at 7:43 PM
Edited

The reporter has re-tested against Meridian 2021.1.2 and is still able to get XSS payload to execute upon clicking, though no longer upon page rendering alone. I'm able to reproduce with Safari 14.1.2, but not with Firefox 90.0.

Assuming a category exists having a name consisting of the following payload:

')alert(document.cookie);//

Then, navigating to Admin -> Manage Surveillance Categories and clicking on the Delete icon next to the payload category results in a JS popup containing the user's cookies, leading to a 500 error page upon dismissal. On Firefox I don't get the JS popup, only the error page.

I was able to prevent the JS popup in Safari by using a JSTL c:set / fn:replace to remove all semicolons from category.name, store that safer value into a temporary variable, and use the temporary variable in place category.name inside the onclick property for the delete icon.

A more complete fix would also add input validation when creating a category.

I have a more detailed PDF from the reporter; I'm happy to share that in a less open channel since its content identifies the reporter's employer.

Christian Pape May 5, 2021 at 10:54 AM

Merged.

Christian Pape April 20, 2021 at 12:25 PM

Merged.

Christian Pape April 12, 2021 at 9:45 AM

Christian Pape April 8, 2021 at 10:06 AM

Fixed

Details

Assignee

Reporter

Labels

HB Backlog Status

Components

Sprint

Fix versions

Affects versions

Priority

PagerDuty

Created April 1, 2021 at 6:25 PM
Updated November 10, 2022 at 7:15 PM
Resolved May 5, 2021 at 10:54 AM