CVE-2023-36812 Remote Code Execution in OpenTSDB
Attackers can execute arbitrary code by injecting commands into Gnuplot configuration files within OpenTSDB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36812?
CVE-2023-36812 is a critical command injection vulnerability in opentsdb, published on 30 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.
Weakness: CWE-74
Which versions are affected by CVE-2023-36812?
2 open source packages ship an affected version, including net.opentsdb:opentsdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
net.opentsdb:opentsdb Maven | All versions | 2.4.2 |
net.opentsdb:opentsdb Maven | All versions | 2.4.2 |
Products include Opentsdb Opentsdb.
How do I fix CVE-2023-36812?
Upgrade net.opentsdb:opentsdb to 2.4.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-36812 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36812 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Other vulnerabilities in opentsdb
Sources
Also known as GHSA-76f7-9v52-v2fw.