CVE-2021-3396 OpenNMS Horizon RCE via JEXL2 expression

What is CVE-2021-3396?

CVE-2021-3396 is a high-severity code injection vulnerability in n/a, published on 17 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.

Which versions are affected by CVE-2021-3396?

8 open source packages ship an affected version, including org.opennms.features:org.opennms.features.measurements, org.opennms:opennms and org.opennms:opennms-provision. It affects 3 products.

Products include Opennms Horizon, Opennms Meridian, Opennms Newts.

How do I fix CVE-2021-3396?

Upgrade org.opennms.features:org.opennms.features.measurements to 27.0.4 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-3396 being exploited?

There is no known exploitation of CVE-2021-3396 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-25931 Cross-Site Request Forgery in OpenNMS Horizon High 8.8
• CVE-2023-0872 ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users High 8.2
• CVE-2023-0870 Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) High 8.1
• CVE-2020-11886 SQL injection in n/a High 8.1
• CVE-2023-40313 Disable BeanShell Interpreter Remote Server Mode High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c3mp-9vx3-2rvv.