module
Pandora FMS Events Remote Command Execution
| Disclosed | Created |
|---|---|
| 06/04/2020 | 07/11/2020 |
Disclosed
06/04/2020
Created
07/11/2020
Description
This module exploits a vulnerability (CVE-2020-13851) in Pandora
FMS versions 7.0 NG 742, 7.0 NG 743, and 7.0 NG 744 (and perhaps
older versions) in order to execute arbitrary commands.
This module takes advantage of a command injection vulnerability in the
`Events` feature of Pandora FMS. This flaw allows users to execute
arbitrary commands via the `target` parameter in HTTP POST requests to
the `Events` function. After authenticating to the target, the module
attempts to exploit this flaw by issuing such an HTTP POST request,
with the `target` parameter set to contain the payload. If a shell is
obtained, the module will try to obtain the local MySQL database
password via a simple `grep` command on the plaintext
`/var/www/html/pandora_console/include/config.php` file.
Valid credentials for a Pandora FMS account are required. The account
does not need to have admin privileges.
This module has been successfully tested on Pandora 7.0 NG 744 running
on CentOS 7 (the official virtual appliance ISO for this version).
FMS versions 7.0 NG 742, 7.0 NG 743, and 7.0 NG 744 (and perhaps
older versions) in order to execute arbitrary commands.
This module takes advantage of a command injection vulnerability in the
`Events` feature of Pandora FMS. This flaw allows users to execute
arbitrary commands via the `target` parameter in HTTP POST requests to
the `Events` function. After authenticating to the target, the module
attempts to exploit this flaw by issuing such an HTTP POST request,
with the `target` parameter set to contain the payload. If a shell is
obtained, the module will try to obtain the local MySQL database
password via a simple `grep` command on the plaintext
`/var/www/html/pandora_console/include/config.php` file.
Valid credentials for a Pandora FMS account are required. The account
does not need to have admin privileges.
This module has been successfully tested on Pandora 7.0 NG 744 running
on CentOS 7 (the official virtual appliance ISO for this version).
Authors
Fernando CatoiraJulio SanchezErik Wynter
Platform
Linux,Unix
Architectures
x86, x64, cmd
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/linux/http/pandora_fms_events_exec
msf /(c) > show actions
...actions...
msf /(c) > set ACTION < action-name >
msf /(c) > show options
...show and set options...
msf /(c) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.