CVE-2017-6188

What it actually does

When CGI graphs are enabled, multiple upper_limit GET parameters allow an authenticated local user to write arbitrary content to any file writable by the www-data user via improper input validation.

Why it matters to the business

Attackers can corrupt or replace configuration, data, or script files on the server, leading to service disruption, data tampering, or potential escalation of access in environments running the affected monitoring software.

How an attack unfolds

An attacker with local or web access to the Munin CGI graph endpoint crafts a request containing repeated upper_limit parameters; the application fails to sanitize the input and writes attacker-controlled data to a chosen file path accessible by the web server process.

How to fix it

Upgrade Munin to version 2.999.6 or later (commit 3757f16bf453f172ca750403156029563405e840) or apply the corresponding fixed packages for addon-resizer-fips and addon-resizer-fips-compat at 1.8.21-r3; disable CGI graph functionality if immediate upgrade is not feasible.

How to confirm the fix worked

Verify the installed Munin version is 2.999.6 or newer, confirm absence of the vulnerable graph CGI code path, and test that repeated upper_limit parameters no longer result in arbitrary file writes.

Typical attack path

1. Identify a Munin instance with CGI graphs enabled and reachable via HTTP
2. Authenticate or access the graph generation endpoint as the www-data user context
3. Submit a GET request containing multiple upper_limit parameters pointing to a target file path
4. Observe successful file overwrite or error confirming write access
5. Leverage the modified file for further persistence, denial of service, or lateral movement

How to detect it

Search web server access logs for graph.cgi or similar endpoints containing multiple occurrences of the upper_limit parameter in a single request; inspect file modification timestamps on configuration and script files owned by www-data for unexpected changes around the time of such requests.

• upper_limit=.*upper_limit=
• GET.*graph.*upper_limit.*upper_limit

What your security team should do

• Apply the listed fixed versions immediately on all affected Munin deployments
• Review web server logs for historical requests containing repeated upper_limit parameters
• Restrict or disable CGI graph access to the minimum required users and networks
• Monitor EPSS and threat intelligence feeds for any future exploitation spikes despite low current scores