CVE-2021-42083 Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335

High 8.7 Published 10 Jul 2023 Updated 22 Sep 2025

Authenticated attackers can inject malicious scripts via webhook URLs in QuantaStor, leading to remote code execution with root privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-42083?

CVE-2021-42083 is a high-severity cross-site scripting vulnerability in OSNEXUS QuantaStor, published on 10 Jul 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An authenticated attacker is able to create alerts that trigger a stored XSS attack.

POC

* go to the alert manager

* open the ITSM tab * add a webhook with the URL/service token value

' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters)

* click add

* click apply

* create a test alert

* The test alert will run the command

“id | tee /tmp/ttttttddddssss” as root.

* after the test alert inspect

/tmp/ttttttddddssss it'll contain the ids of the root user.

Weakness: CWE-79

Which versions are affected by CVE-2021-42083?

It affects 1 product.

Products include Osnexus Quantastor.

How do I fix CVE-2021-42083?

No fix has been published for CVE-2021-42083 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-42083 being exploited?

There is no known exploitation of CVE-2021-42083 in the wild and no public exploit code.

Sources

Also known as GHSA-9c8q-55w7-h67h.