CVE-2023-36812
Description
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit 07c4641471c
and further refined in commit fa88d3e4b
. These patches are available in the 2.4.2
release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config optiontsd.core.enable_ui \= true
and remove the shell files mygnuplot.bat
and mygnuplot.sh
.
GitHub, Inc.
Severity: CRITICAL
CVE ID: CVE-2023-36812
CVSS Score: 9.8
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Proof Of Concept
ErikWynter
An exploit for OpenTSDB <= 2.4.1 cmd injection (CVE-2023-36812/CVE-2023-25826) written in Fortran
Refrence: GitHub