CVE-2021-32099: Artica Pandora FMS Auth Bypass Flaw

CVE-2021-32099 Overview

CVE-2021-32099 is a SQL injection vulnerability [CWE-89] in the pandora_console component of Artica Pandora FMS 742. An unauthenticated remote attacker can manipulate the session_id parameter of /include/chart_generator.php to inject SQL statements. Successful exploitation allows the attacker to upgrade an unprivileged session to an authenticated one, resulting in a login bypass. Pandora FMS is a widely deployed network and infrastructure monitoring platform, making compromised consoles a high-value pivot for attackers. The vulnerability requires no user interaction and is reachable over the network.

Critical Impact

Unauthenticated attackers can bypass authentication on Pandora FMS 742 consoles and gain administrative access to monitoring infrastructure.

Affected Products

• Artica Pandora FMS version 742
• pandora_console component
• Installations exposing /include/chart_generator.php to untrusted networks

Discovery Timeline

• 2021-05-07 - CVE-2021-32099 published to the National Vulnerability Database (NVD)
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32099

Vulnerability Analysis

The flaw resides in the pandora_console web interface, specifically in /include/chart_generator.php. The endpoint accepts a session_id parameter that is concatenated into a SQL query without proper sanitization or parameterization. Because the script can be reached prior to authentication, an attacker does not need valid credentials to trigger the injection.

By crafting a malicious session_id value, the attacker forces the backend SQL query to return data that the application interprets as a valid, privileged session. The application then treats the request as authenticated, granting access to administrative functionality within Pandora FMS. Once authenticated, an attacker can chain this access with other reported flaws in Pandora FMS 742 to achieve remote code execution on the host.

See the SonarSource vulnerability explanation and the PortSwigger Daily Swig analysis for additional technical context.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. User-controlled input from the session_id HTTP parameter is inserted into a database query without prepared statements or input validation, allowing arbitrary SQL syntax to alter query logic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to /include/chart_generator.php with a malicious session_id parameter. The injected SQL modifies the session validation logic so the application accepts the attacker as an authenticated user. Refer to the linked technical references for sanitized exploitation details; no verified public exploit code is included here.

Detection Methods for CVE-2021-32099

Indicators of Compromise

• HTTP requests to /include/chart_generator.php containing SQL syntax (e.g., UNION, SELECT, single quotes, or comment sequences) within the session_id parameter
• Unexpected administrative logins or session creations in Pandora FMS audit logs without prior credential authentication events
• Outbound connections or new scheduled tasks originating from the Pandora FMS host after suspicious web requests

Detection Strategies

• Inspect web server access logs for anomalous session_id values on chart_generator.php, particularly long strings or URL-encoded SQL metacharacters
• Deploy a Web Application Firewall (WAF) rule that blocks SQL injection patterns targeting the pandora_console URI namespace
• Correlate database query errors in MySQL/MariaDB logs with concurrent web requests to the affected endpoint

Monitoring Recommendations

• Forward Pandora FMS web and database logs to a centralized SIEM for cross-source correlation
• Alert on privilege changes or new administrative accounts created within Pandora FMS
• Monitor the host process tree for child processes spawned from the PHP-FPM or web server worker after suspicious requests

How to Mitigate CVE-2021-32099

Immediate Actions Required

• Upgrade Pandora FMS to version 743 or later, which addresses this vulnerability per the vendor release notes
• Restrict network access to the Pandora FMS console using firewall rules or VPN-only access until patching is complete
• Review web server and database logs for signs of exploitation prior to the patch being applied

Patch Information

Artica resolved the issue in Pandora FMS 743. Administrators should consult the Pandora FMS 743 release announcement for upgrade procedures and verify the installed version after deployment.

Workarounds

• Block external access to /include/chart_generator.php at the reverse proxy or WAF layer
• Enforce IP allow-listing on the Pandora FMS management interface
• Apply WAF signatures that reject requests containing SQL metacharacters in the session_id parameter

# Example nginx configuration to block external access to the vulnerable endpoint
location ~* /include/chart_generator\.php {
    allow 10.0.0.0/8;       # internal management network
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}