OpenNebula Stored Cross-Site Scripting Vulnerability in Zone Attribute

A stored cross-site scripting vulnerability has been identified in OpenNebula version 6.10.0.1. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the zone attribute parameter. The issue is present in the OpenNebula Sunstone component.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, inject a payload, such as an image tag with an 'onerror' event, into the zone attribute parameter. Once the payload is saved, it will be executed when the zone attribute is viewed, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to upgrade to OpenNebula version 7.0 or later.