Stored Cross Site-Scripting in Agent Manager

The primary impact of CVE-2022-2059 is the potential for an attacker to execute arbitrary JavaScript code within the Pandora FMS web interface. This can be achieved by crafting a malicious script and injecting it through the agent alias field during agent creation. Successful exploitation could allow an attacker to steal session cookies, impersonate legitimate administrators, modify system configurations, or deface the web interface. The requirement for administrator privileges limits the immediate blast radius, but a compromised administrator account could grant access to sensitive data and systems managed by Pandora FMS. While no public exploits are currently known, the ease of exploitation makes this a concerning vulnerability, particularly for organizations relying on Pandora FMS for critical monitoring and alerting.

Organizations heavily reliant on Pandora FMS for system monitoring and alerting are at risk, particularly those with a large number of administrator accounts or those who have not implemented strong access controls. Shared hosting environments where multiple users share a single Pandora FMS instance are also at increased risk, as a compromised administrator account could potentially impact all users on the shared server.

• nagios / web: Examine Pandora FMS access logs for unusual activity related to agent creation, specifically looking for requests containing suspicious characters or script tags in the alias parameter. • generic web: Use curl to test agent creation endpoints with a simple XSS payload in the alias field. Check the response for signs of script execution (e.g., an alert box).

curl -X POST -d "alias=<script>alert('XSS')</script>" <pandora_fms_agent_creation_url>

• generic web: Review Pandora FMS error logs for any JavaScript errors or exceptions that might indicate a successful XSS attack.

1. 2022-07-25Disclosure

   disclosure

2. 2022-07-25Patch

   patch

1. 已保留2022-06-13
2. 发布日期2022-07-25
3. 修改日期2024-09-16
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-2059 is to upgrade to a patched version of Pandora FMS. Refer to the vendor's advisory for the specific version containing the fix. If upgrading immediately is not feasible, consider implementing strict input validation on the agent alias field to sanitize any potentially malicious characters. While not a complete solution, this can reduce the attack surface. Additionally, review and restrict administrator privileges to the minimum necessary for each user. Monitor web application firewalls (WAFs) for suspicious activity related to script injection attempts. After upgrading, confirm the vulnerability is resolved by attempting to create an agent with a specially crafted alias containing a simple JavaScript payload (e.g., <script>alert('XSS')</script>).