Cross-Site Request Forgery in Pandora FMS Allows Event Response Deletion

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS versions 777 and later. It allows an attacker to trick an authenticated administrator into visiting a malicious page, which then sends a forged GET request to delete event responses without proper authorization.

Useful 0 Not Useful 0

Detection Guidance

Detecting this CSRF vulnerability requires checking for unauthorized event response deletions in Pandora FMS logs. Look for GET requests to event deletion endpoints from authenticated administrators. Review server access logs for suspicious GET requests targeting event management URLs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete important event responses in your Pandora FMS system, potentially disrupting monitoring and management of your infrastructure. This could lead to loss of critical data or operational issues if responses are unintentionally removed.

Useful 0 Not Useful 0

Compliance Impact

This CSRF vulnerability could potentially allow unauthorized actions (deletion of event responses) by tricking an authenticated administrator into visiting a malicious page. This may impact compliance by violating data integrity and access control requirements in standards like GDPR (Article 32) and HIPAA (Safeguard requirements), as unauthorized modifications or deletions of data could occur without proper authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Pandora FMS to a version prior to 777. Disable GET requests for sensitive operations like event deletions. Implement CSRF tokens for all state-changing requests. Restrict administrative access to trusted networks only.

Useful 0 Not Useful 0