Pandora FMS OS Command Injection Vulnerability in Netflow Directory Field

A command injection vulnerability has been identified in Pandora FMS versions 774 to 778. This issue arises from improper handling of special elements in the Netflow directory field, which may allow for OS command injection. The vulnerability is present in the Netflow function of the application.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the server where Pandora FMS is running.

Reproduction

To reproduce this vulnerability, navigate to the Netflow directory field within the affected versions of Pandora FMS. Introduce shell metacharacters in the Netflow parameters, such as 'ip_dst', 'dst_port', or 'src_port'. This can be done through the Netflow live view operation, which will trigger the command injection by executing the injected commands on the server.

Remediation

Users can update to Pandora FMS version 779 or later, where this vulnerability has been addressed.