CVE-2021-32098
📋 TL;DR
CVE-2021-32098 is a critical vulnerability in Artica Pandora FMS that allows unauthenticated attackers to perform Phar deserialization, potentially leading to remote code execution. This affects Pandora FMS version 742 and earlier. Organizations running vulnerable versions are at risk of complete system compromise.
💻 Affected Systems
- Artica Pandora FMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with remote code execution, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to web server compromise, data exfiltration, and potential ransomware deployment.
If Mitigated
Attack blocked at network perimeter or detected before exploitation; limited impact if proper segmentation exists.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 743 and later
Vendor Advisory: https://pandorafms.com/blog/whats-new-in-pandora-fms-743/
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download Pandora FMS 743 or later from official vendor site. 3. Follow vendor upgrade documentation. 4. Restart Pandora FMS services. 5. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to Pandora FMS web interface to trusted IP addresses only
# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
# Example iptables rule: iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
Web Application Firewall
allDeploy WAF with rules to block Phar deserialization attempts
# ModSecurity rule example: SecRule ARGS "@rx phar://" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate Pandora FMS server in separate network segment with strict firewall rules
- Implement application-level monitoring and alerting for suspicious file operations
🔍 How to Verify
Check if Vulnerable:
Check Pandora FMS version via web interface or configuration files; versions 742 or earlier are vulnerable.Check Version:
grep version /var/www/html/pandora_console/include/config.php | head -1Verify Fix Applied:
Verify version is 743 or later and test that Phar deserialization attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file operations in web server logs
- Phar protocol usage in request logs
- Unexpected process execution from web user context
Network Indicators:
- HTTP requests containing 'phar://' strings
- Unusual outbound connections from Pandora FMS server
SIEM Query:
source="web_server.log" AND "phar://" OR source="pandora.log" AND "deserialization"🔗 References
- https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained
- https://pandorafms.com/blog/whats-new-in-pandora-fms-743/
- https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attack
- https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained
- https://pandorafms.com/blog/whats-new-in-pandora-fms-743/
- https://portswigger.net/daily-swig/multiple-vulnerabilities-in-pandora-fms-could-trigger-remote-execution-attack
