Pandora FMS auth RCE [CVE-2024-11320]

[h00die-gr3y]

Last one for this year ;-)

Pandora FMS is a monitoring solution that provides full observability for your organization's technology.
This module exploits an command injection vulnerability (CVE-2024-11320) in the LDAP authentication mechanism of Pandora FMS.
You need have admin access at the Pandora FMS Web application in order to execute this RCE.
This access can be achieved leveraging a default password weakness in Pandora FMS that allows an attacker to access the Pandora FMS MySQL database, create a new admin user and gain administrative access to the Pandora FMS Web application.
The attack can be remotely executed over the WAN as long as the MySQL services are exposed to the outside world.
This issue affects Pandora FMS Community, Free and Enterprise edition: from 718 through <= 777.4

[Chocapikk]

Hi @h00die-gr3y, I noticed that both the file name and the module title mention preauth, but the exploitation clearly requires admin credentials or access to the MySQL database to create an admin user. Since this isn't a true pre-authentication exploit, it might be misleading. Would it be possible to update the file name, module title, and description to reflect this correctly as a post-auth requirement?

[github-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[h00die-gr3y]

Hi @h00die-gr3y, I noticed that both the file name and the module title mention preauth, but the exploitation clearly requires admin credentials or access to the MySQL database to create an admin user. Since this isn't a true pre-authentication exploit, it might be misleading. Would it be possible to update the file name, module title, and description to reflect this correctly as a post-auth requirement?

Done. See 2abde4c.

[msutovsky-r7]

Thanks @h00die-gr3y, I have submitted few comments to the code, the exploit is functional though. Also, can you please submit documentation for the module?

[h00die-gr3y]

Dear Reviewers,
The second release cf5b26d was tested against most of the Pandora FMS versions.
It triggered quite some changes where password cryptographic hashing algorithms were changed from plain MD5 to BCRYPT in later versions of Pandora FMS. Also the csrf_hidden-codes were not used in older versions which now has been catered for.

Finally, the command injection vulnerability (GHSA-882x-5jhv-r9x4) in the LDAP authentication mechanism of Pandora FMS did not work for versions lower then v7.0NG.718, so the vulnerability check has been adapted to handle this.

Documentation will be provided over the weekend.