CVE-2021-32099: Artica Pandora FMS Auth Bypass Flaw

CVE-2021-32099 Overview

CVE-2021-32099 is a SQL injection vulnerability [CWE-89] in the pandora_console component of Artica Pandora FMS 742. An unauthenticated remote attacker can manipulate the session_id parameter of /include/chart_generator.php to inject SQL statements. Successful exploitation allows the attacker to upgrade an unprivileged session to an authenticated one, resulting in a login bypass. Pandora FMS is a widely deployed network and infrastructure monitoring platform, making compromised consoles a high-value pivot for attackers. The vulnerability requires no user interaction and is reachable over the network.

Critical Impact
Unauthenticated attackers can bypass authentication on Pandora FMS 742 consoles and gain administrative access to monitoring infrastructure.

Affected Products

Artica Pandora FMS version 742
pandora_console component
Installations exposing /include/chart_generator.php to untrusted networks

Discovery Timeline

2021-05-07 - CVE-2021-32099 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32099

Vulnerability Analysis

The flaw resides in the pandora_console web interface, specifically in /include/chart_generator.php. The endpoint accepts a session_id parameter that is concatenated into a SQL query without proper sanitization or parameterization. Because the script can be reached prior to authentication, an attacker does not need valid credentials to trigger the injection.

By crafting a malicious session_id value, the attacker forces the backend SQL query to return data that the application interprets as a valid, privileged session. The application then treats the request as authenticated, granting access to administrative functionality within Pandora FMS. Once authenticated, an attacker can chain this access with other reported flaws in Pandora FMS 742 to achieve remote code execution on the host.

See the SonarSource vulnerability explanation and the PortSwigger Daily Swig analysis for additional technical context.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. User-controlled input from the session_id HTTP parameter is inserted into a database query without prepared statements or input validation, allowing arbitrary SQL syntax to alter query logic.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to /include/chart_generator.php with a malicious session_id parameter. The injected SQL modifies the session validation logic so the application accepts the attacker as an authenticated user. Refer to the linked technical references for sanitized exploitation details; no verified public exploit code is included here.

Detection Methods for CVE-2021-32099

Indicators of Compromise

HTTP requests to /include/chart_generator.php containing SQL syntax (e.g., UNION, SELECT, single quotes, or comment sequences) within the session_id parameter
Unexpected administrative logins or session creations in Pandora FMS audit logs without prior credential authentication events
Outbound connections or new scheduled tasks originating from the Pandora FMS host after suspicious web requests

Detection Strategies

Inspect web server access logs for anomalous session_id values on chart_generator.php, particularly long strings or URL-encoded SQL metacharacters
Deploy a Web Application Firewall (WAF) rule that blocks SQL injection patterns targeting the pandora_console URI namespace
Correlate database query errors in MySQL/MariaDB logs with concurrent web requests to the affected endpoint

Monitoring Recommendations

Forward Pandora FMS web and database logs to a centralized SIEM for cross-source correlation
Alert on privilege changes or new administrative accounts created within Pandora FMS
Monitor the host process tree for child processes spawned from the PHP-FPM or web server worker after suspicious requests

How to Mitigate CVE-2021-32099

Immediate Actions Required

Upgrade Pandora FMS to version 743 or later, which addresses this vulnerability per the vendor release notes
Restrict network access to the Pandora FMS console using firewall rules or VPN-only access until patching is complete
Review web server and database logs for signs of exploitation prior to the patch being applied

Patch Information

Artica resolved the issue in Pandora FMS 743. Administrators should consult the Pandora FMS 743 release announcement for upgrade procedures and verify the installed version after deployment.

Workarounds

Block external access to /include/chart_generator.php at the reverse proxy or WAF layer
Enforce IP allow-listing on the Pandora FMS management interface
Apply WAF signatures that reject requests containing SQL metacharacters in the session_id parameter

bash

# Example nginx configuration to block external access to the vulnerable endpoint
location ~* /include/chart_generator\.php {
    allow 10.0.0.0/8;       # internal management network
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}