MODULE

Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin

Try Surface Command Get a continuous 360° view of your attack surface
Back to Search

Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin

Disclosed
03/17/2025
Created
04/08/2025

Description

Pandora FMS is a monitoring solution that provides full observability for your organization's technology. This module exploits an command injection vulnerability in the `chromium-path` or `phantomjs-bin` directory setting at the application settings page of Pandora FMS. You need have admin access at the Pandora FMS Web application in order to execute this RCE. This access can be achieved by knowing the admin credentials to access the web application or leveraging a default password vulnerability in Pandora FMS that allows an attacker to access the Pandora FMS MySQL database, create a new admin user and gain administrative access to the Pandora FMS Web application. This attack can be remotely executed over the WAN as long as the MySQL services are exposed to the outside world. This issue affects Community, Free and Enterprise editions: - chromium-path: from v7.0NG.768 through <= v7.0NG.780 - phantomjs-bin: from v7.0NG.724 through <= v7.0NG.767 Note: use target setting 2 "Tiny Reverse Netcat Command" for versions <= v7.0NG.738

Author(s)

  • h00die-gr3y <h00die.gr3y@gmail.com>

Platform

Linux,PHP,Unix

Architectures

cmd, php

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/pandora_fms_auth_rce_cve_2024_12971
msf exploit(pandora_fms_auth_rce_cve_2024_12971) > show targets
    ...targets...
msf exploit(pandora_fms_auth_rce_cve_2024_12971) > set TARGET < target-id >
msf exploit(pandora_fms_auth_rce_cve_2024_12971) > show options
    ...show and set options...
msf exploit(pandora_fms_auth_rce_cve_2024_12971) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;