module

Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin

Try Surface Command
Back to search
Disclosed
03/17/2025
Created
04/08/2025

Description

Pandora FMS is a monitoring solution that provides full observability for your organization's
technology. This module exploits an command injection vulnerability in the `chromium-path` or
`phantomjs-bin` directory setting at the application settings page of Pandora FMS.
You need have admin access at the Pandora FMS Web application in order to execute this RCE.
This access can be achieved by knowing the admin credentials to access the web application or
leveraging a default password vulnerability in Pandora FMS that allows an attacker to access
the Pandora FMS MySQL database, create a new admin user and gain administrative access to the
Pandora FMS Web application. This attack can be remotely executed over the WAN as long as the
MySQL services are exposed to the outside world.
This issue affects Community, Free and Enterprise editions:
- chromium-path: from v7.0NG.768 through - phantomjs-bin: from v7.0NG.724 through
Note: use target setting 2 "Tiny Reverse Netcat Command" for versions

Author

h00die-gr3y

Platform

Linux,PHP,Unix

Architectures

cmd, php

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:

    msf > use exploit/linux/http/pandora_fms_auth_rce_cve_2024_12971
    msf /(1) > show actions
        ...actions...
    msf /(1) > set ACTION < action-name >
    msf /(1) > show options
        ...show and set options...
    msf /(1) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today