Impact

OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration.

Patches

Patched in 07c4641471c6f5c2ab5aab615969e97211eb50d9 and further refined in fa88d3e

Workarounds

Disable Gunuplot via tsd.core.enable_ui = true and remove the shell files https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.bat and https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.sh.

how it differs from https://nvd.nist.gov/vuln/detail/CVE-2020-35476

The CVE above refers to version 2.4.0. This vulnerability bypasses the restrictions posed by the fix suggested in the ticket, so the remote code execution is operational for version 2.4.1.

Reported By

Gal Goldstein - Oxeye
Daniel Abeles - Oxeye