Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• artica pandora fmsup to 3.1 inclusive
• artica pandora fms1.2
• artica pandora fms1.3
• artica pandora fms1.3.1
• artica pandora fms2.0
• artica pandora fms2.1
• artica pandora fms2.1.1
• artica pandora fms3.0
• artica pandora fms3.1

Other highest-scoring records for the same primary product.

• CVE-2010-4279The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attacker
  60This week
• CVE-2024-12971QuickShell Authenticated Command Injection
  52Plan
• CVE-2019-20224netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell
  50Plan
• CVE-2021-32099A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u
  43Plan
• CVE-2018-11221Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via includ
  41Plan
• CVE-2021-32098Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.