Thruk has Path Traversal Vulnerability in panorama.pm

Vulnerability

CVE-2023-34096 is a path traversal vulnerability in Thruk, a multibackend monitoring web interface supporting Naemon, Icinga, Shinken, and Nagios. The flaw resides in the panorama.pm plugin file (within the plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm path) [2]. Affected versions are Thruk 3.06 and all earlier releases [1][2][4]. The location parameter, which controls the destination folder for uploaded background images in the Dashboard feature, is not filtered, validated, or sanitized [2][4]. An attacker must be authenticated to reach the vulnerable code path [2][4].

Exploitation

An attacker with valid authentication can exploit the vulnerability by intercepting a legitimate image upload request (e.g., via Burp Suite) and modifying the location parameter to include path traversal sequences such as ../ [1][2][4]. The unsanitized location value is concatenated with the filename, and the resulting path is used to move the uploaded file via a move_uploaded_file operation [2][4]. No special privileges beyond standard user access are required; the attacker only needs a writable target directory on the filesystem.

Impact

Successful exploitation allows a remote authenticated attacker to upload arbitrary files (with allowed extensions, e.g., image files) to any folder on the system that has write permissions [1][2][4]. This could lead to unauthorized file writes, potentially enabling code execution (e.g., by overwriting a Perl module or configuration file) or denial of service. The exact CIA impact depends on the target directory and the attacker's objectives.

Mitigation

The vulnerability is fixed in Thruk version 3.06.2, released after the disclosure [1][2][3]. Users should upgrade immediately to 3.06.2 or later [2][3]. No workarounds are available in the references; however, restricting write permissions on sensitive directories and monitoring file upload logs may reduce risk. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1][2][4].