CVE-2021-34074
📋 TL;DR
PandoraFMS versions up to 7.54 contain an arbitrary file upload vulnerability in the File Manager component. Attackers can bypass built-in protections using relative paths to upload malicious files, leading to remote command execution. Organizations running affected PandoraFMS versions are at risk.
💻 Affected Systems
- PandoraFMS
📦 What is this software?
Pandora Fms by Pandorafms
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/system privileges, data exfiltration, lateral movement across network, and persistent backdoor installation.
Likely Case
Unauthorized file upload leading to web shell deployment, command execution with web server privileges, and potential privilege escalation.
If Mitigated
Limited impact with proper network segmentation, file upload restrictions, and monitoring preventing successful exploitation.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once access is obtained. The bypass technique using relative paths is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.55 and later
Vendor Advisory: https://pandorafms.com/blog/pandora-fms-755-release/
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download PandoraFMS 7.55 or later from official repository. 3. Follow upgrade documentation for your platform. 4. Restart PandoraFMS services. 5. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Disable File Manager
allTemporarily disable the vulnerable File Manager component
# Edit PandoraFMS configuration to disable file manager access
Restrict File Upload Types
allImplement strict file type validation and upload restrictions
# Configure web server to block uploads of executable file types
🧯 If You Can't Patch
- Implement strict network access controls to limit PandoraFMS access to trusted IPs only
- Deploy WAF rules to block file upload attempts with relative paths and suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check PandoraFMS version via web interface or configuration files. If version is 7.54 or lower, system is vulnerable.Check Version:
grep 'version' /etc/pandora/pandora_server.conf or check via web interfaceVerify Fix Applied:
Verify version is 7.55 or higher and test file upload functionality with restricted file types.📡 Detection & Monitoring
Log Indicators:
- File upload attempts with relative paths
- Unusual file creation in upload directories
- Execution of unexpected system commands
Network Indicators:
- HTTP POST requests to file manager endpoints with suspicious file extensions
- Outbound connections from PandoraFMS server to unexpected destinations
SIEM Query:
source="pandorafms" AND (url="*file_manager*" OR file_upload="*") AND (path="../" OR extension="php|jsp|asp")