OS Command Injection in OpenTSDB
Critical severity
GitHub Reviewed
Published
Aug 2, 2021
to the GitHub Advisory Database
•
Updated Jan 31, 2023
Description
Published by the National Vulnerability Database
Dec 16, 2020
Reviewed
Jul 26, 2021
Published to the GitHub Advisory Database
Aug 2, 2021
Last updated
Jan 31, 2023
A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
References