The OpenNMS Bug: Urgent Patch Required to Protect Against Data Theft and Denial of Service Attacks

High-Severity Vulnerability Patched in OpenNMS: A Cause for Concern

Introduction

OpenNMS, a widely used open source network monitoring software, recently faced a high-severity vulnerability. The XML external entity (XXE) injection vulnerability allowed attackers to exfiltrate data, trigger denial-of-service conditions, and send arbitrary HTTP requests to internal and external services. This vulnerability affected both the community-supported and subscription-based versions of OpenNMS, which is trusted by renowned companies such as Cisco, GigaComm, and Savannah River Nuclear Solutions (SRNS). This article explores the implications of the vulnerability, its impact on organizations, and the steps that should be taken to mitigate such risks.

The Vulnerability: CVE-2023-0871

CVE-2023-0871 was discovered by researchers from Synopsys in June. It stems from a permissive XML parser configuration within OpenNMS, making the parser susceptible to XXE attacks. The vulnerability leverages the default credentials for the Realtime Console (RTC) REST API and allows attackers to modify trusted XML data, potentially compromising other physical and virtual systems. The exploit also enables an attacker to view files on the system running the vulnerable application and make HTTP requests to other systems using Server-Side Request Forgery (SSRF).

Impact and Recommended Actions

Organizations heavily rely on OpenNMS for monitoring their networks, applications, servers, and more. As such, the risk of exploitation is a cause for concern. The maintainers of OpenNMS have urged organizations using affected versions to promptly update to the patched versions of Meridian and Horizon. The affected versions of OpenNMS Horizon, identified as 31.0.8 and versions prior to 32.0.2, were described as vulnerable on multiple platforms. The patch provided by OpenNMS comes in the form of Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38, or Horizon 32.0.2 (or newer).

Furthermore, OpenNMS advised organizations to avoid making their instances accessible over the internet and to limit the usage of OpenNMS within the internal network. By following these precautions, the likelihood of exploitation is reduced, with the primary concern shifting towards potential malicious insiders.

Broader Implications and Concerns

This vulnerability is not the first to be uncovered in OpenNMS. In fact, multiple vulnerabilities have been discovered this year alone, some of which have serious implications. For instance, CVE-2023-0870 is a cross-site request forgery issue present in multiple versions of OpenNMS Horizon and Meridian, with a CVSS score of 8.1. Additionally, CVE-2023-0846, an unauthenticated, cross-site scripting vulnerability, affects both OpenNMS versions.

Security and Open Source Software

The discovery of these vulnerabilities raises questions about the security of open source software. While open source software is popular due to its transparency and the collaboration it fosters, it also attracts the attention of attackers seeking to exploit any weaknesses. OpenNMS, a widely adopted platform trusted by major companies, highlights the risk associated with relying solely on community-supported software without the security measures provided by subscription-based versions.

Philosophical Debate: Open Source vs. Proprietary Software

This incident also invites a broader discussion about the relative security of open source and proprietary software. Proponents argue that the open nature of the source code allows for more extensive scrutiny and quicker identification and resolution of vulnerabilities. On the other hand, critics contend that proprietary software provides better security, as it is developed and maintained by professional organizations dedicated to ensuring robust protection.

The Importance of Timely Software Updates

Regardless of whether an organization utilizes open source or proprietary software, the importance of promptly installing updates and patches cannot be overstated. While vulnerabilities are inevitable in any complex software system, the primary defense against their exploitation lies in keeping systems up to date. This incident serves as a reminder for organizations to implement robust software management practices and prioritize timely updates.

Conclusion

The recent high-severity vulnerability in OpenNMS highlights the need for constant vigilance and proactive security measures. The discovery of this vulnerability, along with others earlier this year, underscores the importance of timely updates and adherence to recommended security practices. As the reliance on open source software continues to grow, it is crucial for organizations to assess the associated risks and ensure appropriate security measures are in place. By balancing the benefits and risks, organizations can navigate the complex landscape of cybersecurity, minimizing the potential for data breaches and other security incidents.