CVE-2020-35476
CRITICAL EXPLOITED NUCLEIOpenTSDB 2.4.0 unauthenticated command injection
Title source: metasploitExploitation Summary
CVE-2020-35476 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including glowbase, Shai rod, Erik Wynter, including a Metasploit module exploits/linux/http/opentsdb_yrange_cmd_injection.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-35476, a remote code execution vulnerability in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The exploit uses an SSRF technique to redirect requests and execute arbitrary commands.
Description
A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
Exploits (2)
This repository contains a functional exploit for CVE-2020-35476, a remote code execution vulnerability in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The exploit uses an SSRF technique to redirect requests and execute arbitrary commands.
This Metasploit module exploits an unauthenticated command injection vulnerability in OpenTSDB through 2.4.0 via the yrange parameter to achieve remote code execution as root. It first checks the target's version and configured metrics/aggregators before injecting the payload.
Nuclei Templates (1)
html:"OpenTSDB" || http.html:"opentsdb"
body="opentsdb"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H