Cross-Site Request Forgery in Pandora FMS Allows Alert Deletion

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS versions 777 and later. It allows unauthorized deletion of alert commands when an authenticated administrator visits a malicious page. The vulnerability occurs because GET requests are used for sensitive actions without proper validation.

Useful 0 Not Useful 0

Detection Guidance

Detecting this CSRF vulnerability requires checking for unauthorized deletion of alert commands via GET requests. Monitor web server logs for repeated GET requests targeting alert deletion endpoints from administrator sessions. Look for unusual sequential requests or patterns indicating malicious activity.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick an administrator into visiting a malicious page, leading to unauthorized deletion of alert commands. This could disrupt monitoring and alerting systems, potentially causing missed critical events or system failures.

Useful 0 Not Useful 0

Compliance Impact

This CSRF vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized actions (deletion of alert commands) through malicious requests. Unauthorized changes to systems handling sensitive data may violate integrity and access control requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Pandora FMS to a patched version. Disable GET requests for sensitive actions like alert deletion and enforce POST requests with CSRF tokens. Review administrator session logs for signs of exploitation and revoke any unauthorized changes.

Useful 0 Not Useful 0