CVE-2024-39915
📋 TL;DR
This vulnerability allows authenticated users with access to Thruk's reporting functionality to execute arbitrary commands on the server via URL parameter injection during PDF report generation. The attack requires valid credentials but can lead to full system compromise. All Thruk users with reporting access are affected.
💻 Affected Systems
- Thruk
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with lateral movement to other systems, data exfiltration, and persistent backdoor installation.
Likely Case
Unauthorized command execution leading to service disruption, configuration changes, or credential theft.
If Mitigated
Limited impact due to network segmentation, minimal user privileges, and proper monitoring catching exploitation attempts.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward via URL parameter manipulation. The vulnerability is in the html2pdf.sh script.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.16
Vendor Advisory: https://github.com/sni/Thruk/security/advisories/GHSA-r7gx-h738-4w6f
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Thruk service. 3. Upgrade to Thruk version 3.16 or later. 4. Restart Thruk service. 5. Verify functionality.
🧯 If You Can't Patch
- Restrict access to reporting functionality to only essential users
- Implement network segmentation to isolate Thruk servers from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Thruk version via web interface or command line. Versions below 3.16 are vulnerable.Check Version:
thruk --versionVerify Fix Applied:
Verify Thruk version is 3.16 or higher and test PDF report generation functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual PDF generation requests
- Suspicious commands in URL parameters
- Unexpected shell script executions from html2pdf.sh
Network Indicators:
- Multiple PDF generation requests from single user
- Unusual outbound connections from Thruk server
SIEM Query:
source="thruk.log" AND ("pdf" OR "report") AND (url_contains(";") OR url_contains("|") OR url_contains("$"))