Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2020-35476 PoC — OpenTSDB 操作系统命令注入漏洞

Source
https://github.com/glowbase/CVE-2020-35476
Associated Vulnerability
Title:OpenTSDB 操作系统命令注入漏洞 (CVE-2020-35476)
Description:OpenTSDB是一套开源的、可扩展的分布式时间序列数据库。 OpenTSDB through 2.4.0版本存在操作系统命令注入漏洞，该漏洞源于远程代码执行漏洞通过yrange参数中的命令注入，yrange值被写入tmp目录中的gnuplot文件中。然后通过mygnupload .sh shell脚本执行该文件。
Description
A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter.
Readme
# CVE-2020-35476
A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. 

Not finished and doesn't work. Most of the code is there but payload has to be fixed.
File Snapshot

 [4.0K]  /data/pocs/f6a0388f5f77cb19fa21e963455037aaa7a8ad9c
├── [3.0K]  exploit.py
├── [1.0K]  LICENSE
└── [ 223]  README.md

0 directories, 3 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.