CVE-2023-25826: Command injection in OpenTSDB
Summary
CVE-2023-25826: Command injection in OpenTSDB. Affects net.opentsdb:opentsdb versions < 2.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenTSDB is an open-source time series database that is widely used for storing and analyzing large amounts of time series data. It provides a scalable and distributed architecture for handling high-volume data streams. OpenTSDB is implemented in Java and can be integrated with various applications and systems.
Vulnerability Detail
The vulnerability (CVE-2023-25826) in OpenTSDB allows for command injection due to insufficient validation of parameters passed to the legacy HTTP query API. This vulnerability can be exploited by injecting crafted OS commands into multiple parameters, leading to the execution of malicious code on the OpenTSDB host system. The issue stems from an incomplete fix for a previously disclosed vulnerability (CVE-2020-35476), where regex validation intended to restrict input to the query API fails to properly validate crafted commands, allowing them to bypass the validation process. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the OpenTSDB host system and the legacy HTTP query API. This can be achieved by implementing network-level controls, such as firewalls or access control lists, to limit access to trusted sources only. Additionally, monitoring and analyzing network traffic for any suspicious activity can help detect and mitigate potential command injection attempts.
Conclusion
The command injection vulnerability in OpenTSDB (CVE-2023-25826) poses a critical risk to the security and integrity of the system. It allows for the execution of arbitrary commands on the host system, potentially leading to unauthorized access and data compromise. It is crucial to promptly apply the recommended fix or upgrade to a patched version of OpenTSDB to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net.opentsdb:opentsdb →
FAQ
OpenTSDB is an open-source time series database used for storing and analyzing large amounts of time series data. It provides a scalable and distributed architecture for handling high-volume data streams.
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host system by injecting malicious code into a command parameter.
The vulnerability occurs due to insufficient validation of parameters passed to the legacy HTTP query API. Crafted OS commands can be injected into these parameters, bypassing the intended validation and leading to the execution of malicious code.
The impact of this vulnerability is critical, as it allows an attacker to execute arbitrary commands on the OpenTSDB host system. This can result in unauthorized access, data theft, system compromise, and potential disruption of services.
To mitigate the risk, it is recommended to upgrade to a version of OpenTSDB that includes a complete fix for the vulnerability. Additionally, implementing network-level controls and monitoring network traffic can help detect and prevent command injection attempts.
Related vulnerabilities
Recent vulnerabilities recorded for net.opentsdb:opentsdb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
