Stored XSS in Pandora FMS File Manager Directory Creation

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Pandora FMS's File Manager. It occurs due to missing input validation and output encoding on the directory name parameter when creating a new directory. This allows malicious scripts to be stored and executed without user interaction.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect File Manager's directory creation functionality in Pandora FMS versions 777 and later. Check for improper input validation and output encoding in the directory name parameter. Look for stored XSS payloads in directory names that execute without user interaction.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious scripts into the File Manager, potentially stealing session cookies, redirecting users to phishing pages, or performing unauthorized actions on their behalf. This could lead to data theft or account compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update Pandora FMS to the latest version to address the missing input validation and output encoding issues in the File Manager's Create Directory function.

Useful 0 Not Useful 0