PT-2021-21311 · Artica · Artica Pandora Fms

K4M1Ll0 + 1 · Published 2021-11-03 · Updated 2021-11-05 · CVE-2021-36697

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS versions <=755

Description The issue allows an admin account to overwrite the .htaccess file using the File Manager component. A new .htaccess file can be created with a Rewrite Rule and a type definition, enabling the upload of a normal PHP file with the newly defined "file type". This PHP file can then be executed via an HTTP request.

Recommendations For Artica Pandora FMS versions <=755, consider restricting access to the File Manager component to prevent overwriting the .htaccess file until a fix is available. As a temporary workaround, monitor and limit the creation of new .htaccess files and the upload of PHP files to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-36697

Affected Products

Artica Pandora Fms

References · 6

• 🔥 https://k4m1ll0.com/chained_exploit_htaccess.html · Exploit
• http://artica.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36697 · Security Note
• http://pandora.com · Vendor Advisory
• https://t.me/cibsecurity/31718 · Telegram Post