Uploaded image for project: 'OpenNMS'
  1. OpenNMS
  2. NMS-9668

IOActive: Stored Cross-site Scripting in SNMP Trap Message



    • Horizon - October 11th


      Affected Product

      OpenNMS Horizon


      V 20.1.0 (April 12, 2017)


      OpenNMS receives SNMP traps from hosts that are present in the node list. These trap messages could include data of various types, including strings. However, the filtering method for this data is insufficient, which could allow an attacker to perform stored cross-site scripting attacks. The attacker would need network access to port 162/UDP on the server; once the OpenNMS user is logged and visits a specific page, the vulnerability will be triggered.


      OpenNMS is a carrier-grade, highly integrated, open source platform designed for building network monitoring solutions. There are two distributions of OpenNMS: Meridian and Horizon. Using Meridian is advisable for enterprises and businesses looking for stability and long term support. Horizon is the place where innovation happens quickly and is ideal for monitoring new technologies and IT ecosystems. Both distributions are completely open source.1

      Technical Details

      The user interaction required to perform this attack is minimal. The attacker would only need the logged OpenNMS user to access any section that contains nodes information (nodes, events, notifications, alarms, reports, etc...). At that point, the malicious payload will be executed. The outcome of the attack depends on the privileges of the victim. In the worst-case scenario, if a user with admin privileges is compromised, the attacker may obtain remote privileged shell on the system via different methods.

      The vulnerability lies in the way OpenNMS has implemented its XSS filter. The following regular expressions are used:

      private static final Pattern imgOnErrorPattern = Pattern.compile("(img[^>]+)o(nerror=[^>]+>)", Pattern.CASE_INSENSITIVE);

      (See WebSecurityUtils.java line 52, applied in lines 92-96)

      This approach only detects some specific XSS patterns, skipping most of it. For example, the following trap will evade this filter (XSS in Firefox):

      $ sudo snmptrap -v 1 -c public . 6 5247 13:33:00 s "<marquee onStart=alert(123)>1234567890</marquee>"

      or (XSS in Chrome/Safari/any WebKit browser):

      $ sudo snmptrap -v 1 -c public . 6 5247 13:33:00 s "tst<input type=image src=123 onerror=alert(1)> "

      , where is the host on the network with OpenNMS.
      This will lead to the following XSS:

      (Javascript popup containing string 123)


      Oct 4, 2017: Researchers discovers vulnerability

      Oct XX, 2017: IOActive contacts the vendor




            j-white Jesse White
            jeffg Jeff Gehlbach
            0 Vote for this issue
            2 Start watching this issue