^{CVE-2021-46678:}Cross-site scripting (XSS) vulnerability in Pandora FMS version 756 and below allows attackers to execute JavaScript code via the service name field.

Overview

Pandora FMS is an open-source monitoring solution used by organizations to monitor networks, servers, applications, and systems. The vulnerability (CVE-2021-46678) exists in version 756 and earlier versions of the software. The issue stems from insufficient input validation and output encoding in the service name field, which allows attackers to inject malicious JavaScript code that executes when viewed by users of the application. This is classified as a CWE-79 (Cross-site Scripting) vulnerability. Successful exploitation could lead to session hijacking, credential theft, and unauthorized actions within the Pandora FMS environment.

Remediation

To address this vulnerability, organizations should take the following actions:

1. Update to the latest version of Pandora FMS that contains patches for this vulnerability (version higher than 756).
2. If immediate updating is not possible, implement the following temporary mitigations:
   • Restrict access to the Pandora FMS administrative interface to trusted networks only
   • Implement strict input validation for the service name field
   • Consider using a web application firewall (WAF) to filter potentially malicious inputs
3. Regularly review service configurations and audit for any suspicious service names that may contain JavaScript code
4. Implement the principle of least privilege for all Pandora FMS users
5. Monitor system logs for any signs of exploitation attempts

References

1. Vendor Advisory: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
2. Third Party Advisory: https://www.incibe.es/en/cve-assignment-publication/coordinated-cves
3. CWE-79: Cross-site Scripting: https://cwe.mitre.org/data/definitions/79.html
4. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html