A path traversal vulnerability was identified in the WMI Custom sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• paessler prtg network monitorbefore 23.3.86.1520

Other highest-scoring records for the same primary product.

• CVE-2018-19410PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including adminKEV
  98Now
• CVE-2018-9276An issue was discovered in PRTG Network Monitor before 18.2.39.KEV
  84Now
• CVE-2023-32782A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with wri
  45Plan
• CVE-2020-10374A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted
  40Plan
• CVE-2020-11547PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server it
  37Monitor
• CVE-2018-19204PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and O
  36Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.