PT-2023-20331 · D Link · D-Link Dir-X4860

Jamie Harris · Published 2023-05-03 · Updated 2024-05-22 · CVE-2023-25826

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenTSDB (affected versions not specified) D-Link DIR-X4860 (affected versions not specified)

Description The issue arises from insufficient validation of parameters passed to the legacy HTTP query API, allowing for the injection of crafted OS commands and the execution of malicious code on the host system. This is due to an incomplete fix for a previously disclosed vulnerability. The regex validation implemented to restrict input does not work as intended, enabling crafted commands to bypass validation.

Recommendations For OpenTSDB, as a temporary workaround, consider disabling the legacy HTTP query API until a patch is available. For D-Link DIR-X4860, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-25826

GHSA-H475-7V3C-26Q7

Affected Products

D-Link Dir-X4860

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opentsdb_key_cmd_injection.rb · Exploit
• https://github.com/OpenTSDB/opentsdb/pull/2275 · Patch
• https://osv.dev/vulnerability/GHSA-h475-7v3c-26q7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25826 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25826 · Vendor Advisory
• https://github.com/OpenTSDB/opentsdb · Note
• https://twitter.com/hack_git/status/1700763709470105832 · Twitter Post
• https://synopsys.com/blogs/software-security/opentsdb · Note
• https://twitter.com/piedpiper1616/status/1699950030675951724 · Twitter Post
• http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html · Note
• https://twitter.com/ET_Labs/status/1793377173371527356 · Twitter Post
• https://twitter.com/HunterMapping/status/1700811356629262446 · Twitter Post
• https://t.me/cvenotify/57840 · Telegram Post
• https://t.me/cibsecurity/63240 · Telegram Post