CVE-2023-25826 in the critical feed json
Remote Code Execution in OpenTSDB
published 2023-05-03 3 y ago modified 2026-06-17 4 mo ago also GHSA-h475-7v3c-26q7 , EUVD-2023-1552
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 43.0%
- EPSS 43.0% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.
Patch / fix
- github.com/OpenTSDB/opentsdb#2275 pull request
Timeline
- Published
- First public exploit (Metasploit exploit/linux/http/opentsdb_key_cmd_injection)
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
43.04% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/opentsdb_key_cmd_injection OpenTSDB 2.4.1 unauthenticated command injection metasploit exploit, excellent rank, 2023-07-01
- Nuclei template OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | net.opentsdb:opentsdb | <=2.4.1 |
no fix listed |
Affected products
- OpenTSDB OpenTSDB
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/OpenTSDB/opentsdb/pull/2275
web, patch
-
synopsys.com
/blogs/software-security/opentsdb/
third-party-advisory
-
packetstormsecurity.com
/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-25826
advisory
-
github.com
/OpenTSDB/opentsdb
package
-
synopsys.com
/blogs/software-security/opentsdb
web
Sources
- CVE List CVE-2023-25826
- GitHub Advisory GHSA-h475-7v3c-26q7
- NVD CVE-2023-25826
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.