CVE-2020-35476
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on OpenTSDB servers by injecting malicious code into the yrange parameter. Attackers can achieve full system compromise through command injection. All OpenTSDB installations up to version 2.4.0 are affected.
💻 Affected Systems
- OpenTSDB
📦 What is this software?
Opentsdb by Opentsdb
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root privileges, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Remote code execution leading to service disruption, data manipulation, and potential cryptocurrency mining or ransomware deployment.
If Mitigated
Limited impact with proper network segmentation, minimal privileges, and input validation controls in place.
🎯 Exploit Status
Public exploit code available, simple HTTP request with crafted yrange parameter can trigger RCE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.1 and later
Vendor Advisory: https://github.com/OpenTSDB/opentsdb/issues/2051
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Download OpenTSDB 2.4.1 or later from official repository. 3. Stop OpenTSDB service. 4. Replace with patched version. 5. Restart OpenTSDB service.
🔧 Temporary Workarounds
Disable Graph Handler
linuxDisable the vulnerable GraphHandler component if graphing features are not required.
Modify tsd.core.plugin_path in opentsdb.conf to exclude GraphHandler
Input Validation Filter
allImplement web application firewall or proxy to filter malicious yrange parameters.
Configure WAF rules to block requests containing shell metacharacters in yrange parameter
🧯 If You Can't Patch
- Network segmentation: Isolate OpenTSDB servers from critical systems and internet
- Implement strict input validation at application layer or reverse proxy
🔍 How to Verify
Check if Vulnerable:
Check if OpenTSDB version is 2.4.0 or earlier and GraphHandler is enabled in configuration.Check Version:
grep 'version' /path/to/opentsdb/VERSION or check startup logsVerify Fix Applied:
Verify OpenTSDB version is 2.4.1 or later and test yrange parameter injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual gnuplot execution patterns
- Suspicious commands in /tmp directory
- HTTP requests with shell metacharacters in yrange parameter
Network Indicators:
- HTTP POST requests to /q endpoint with unusual yrange values
- Outbound connections from OpenTSDB to unexpected destinations
SIEM Query:
source="opentsdb" AND (yrange CONTAINS "$" OR yrange CONTAINS "|" OR yrange CONTAINS ";" OR yrange CONTAINS "`")