CVE-2024-11320

What it actually does

CVE-2024-11320 is a critical command injection vulnerability in the Pandora FMS LDAP authentication mechanism affecting versions 700 through 777.4. The vulnerable LDAP authentication workflow fails to safely handle attacker-controlled input before using it in server-side command execution context, allowing an unauthenticated or low-interaction attacker who can reach the Pandora FMS web interface and trigger LDAP authentication behavior to execute arbitrary operating-system commands with the privileges of the Pandora FMS web/application process. Because this is server-side command execution, successful exploitation can lead to full application compromise, credential theft, persistence, lateral movement, and potentially complete host takeover depending on local privileges and hardening.

Why it matters to the business

A successful exploit can let an attacker take control of the monitoring platform, which is especially high impact because Pandora FMS often has visibility into infrastructure, stored credentials, integrations, alerting workflows, and privileged connectivity to monitored systems. Compromise may result in monitoring outages, falsified alerts, stolen infrastructure credentials, disruption of incident response visibility, and use of the monitoring server as a pivot point into other systems. The risk is urgent: the vulnerability has a CVSS score of 9.8, a very high EPSS score of 0.91128, is described as weaponized, and has been public for a long period, meaning broad scanning and exploitation attempts should be expected even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable Pandora FMS Console running an affected version. They then interact with the LDAP authentication path or configuration-dependent login workflow and provide crafted input containing shell metacharacters or command-substitution syntax. Because the LDAP authentication mechanism passes unsanitized input into a command execution context, the server interprets part of the supplied data as an operating-system command. Initial payloads commonly confirm execution through simple commands such as user, hostname, DNS, HTTP callback, or file-write checks. After confirming code execution, an attacker may download a web shell or implant, enumerate local configuration files, extract database and integration credentials, tamper with monitoring configuration, disable or alter alerts, and use the monitoring server’s network position to reach additional internal assets.

How to fix it

Upgrade Pandora FMS to a fixed release newer than 777.4, or the latest vendor-supported version, as soon as possible. If an exact fixed package is provided by the vendor for the deployed branch, use that release or later; otherwise treat all versions 700 through 777.4 as vulnerable and unsupported for this issue. If immediate upgrade is not possible, restrict access to the Pandora FMS Console to trusted administrative networks or VPN users only, disable LDAP authentication if it is not required, place compensating controls such as a WAF or reverse proxy in front of the console to block command-injection metacharacters in authentication requests, and harden the host by limiting outbound network access from the web process. Rotate credentials stored in or accessible from Pandora FMS after patching, especially database, LDAP bind, API, SSH, SNMP, cloud, webhook, and integration secrets, because successful exploitation may have exposed them.

How to confirm the fix worked

Confirm the running Pandora FMS version is newer than 777.4 or matches the vendor’s fixed release for the installed branch. Verify the package version from the application UI, package manager, release files, and container image tags where applicable. Confirm that LDAP authentication still works after upgrade and that authentication requests no longer allow shell metacharacters or command-substitution syntax to influence server-side execution. Review exposure by checking whether the Pandora FMS Console is reachable from the internet or broad internal networks. Validate compensating controls by confirming that requests containing encoded or literal command-injection characters are blocked or rejected. If exploitation is suspected, perform credential rotation and host-level forensic review rather than relying only on version validation.

Typical attack path

1. Discover a Pandora FMS Console exposed to the network or reachable from a compromised internal host.
2. Fingerprint the application version or infer exposure based on response behavior and deployment age.
3. Submit crafted LDAP authentication input containing command injection characters or encoded shell syntax.
4. Confirm command execution using a harmless callback, file creation, or command output side effect.
5. Run reconnaissance commands to identify the operating system, user context, network interfaces, and application paths.
6. Read Pandora FMS configuration files and credentials accessible to the web/application process.
7. Deploy a web shell, reverse shell, cron job, or other persistence mechanism if permissions allow.
8. Use stolen credentials and the monitoring server’s network access to pivot to managed infrastructure.
9. Tamper with monitoring rules, alerts, or logs to reduce detection and prolong access.

How to detect it

Investigate whether exploitation has already occurred by reviewing web server access logs, Pandora FMS application logs, authentication logs, reverse proxy/WAF logs, EDR telemetry, shell history, process execution telemetry, and outbound network logs from Pandora FMS servers. Focus on requests to login, authentication, LDAP, or console endpoints that contain shell metacharacters, command substitution, URL-encoded control characters, or references to common tools such as curl, wget, bash, sh, nc, python, perl, php, powershell, chmod, chattr, or crontab. On Linux hosts, look for web/application processes spawning shell interpreters or network utilities, especially apache, httpd, nginx, php-fpm, or pandora-related processes launching /bin/sh, /bin/bash, curl, wget, nc, python, perl, or php. Check for new or modified files under Pandora FMS web directories, temporary directories, and upload/plugin paths. Review outbound DNS and HTTP/S connections immediately following suspicious authentication requests, as command-injection probes often use callbacks to attacker-controlled infrastructure. Also inspect local persistence mechanisms such as cron, systemd units, rc.local, authorized_keys, unexpected users, and recently modified executable files.

• /var/www/html/pandora_console/
• /var/log/pandora/pandora_server.log
• /var/log/apache2/access.log
• /var/log/apache2/error.log
• /var/log/httpd/access_log
• /var/log/httpd/error_log
• /var/log/nginx/access.log
• /var/log/nginx/error.log
• ldap
• LDAP
• %3B
• %7C
• %26
• %60
• %24%28
• ;curl
• ;wget
• |curl
• |wget
• `curl
• `wget
• $(curl
• $(wget
• /bin/sh
• /bin/bash
• bash -c
• sh -c
• curl http
• curl https
• wget http
• wget https
• nc -e
• ncat -e
• python -c
• perl -e
• php -r
• chmod +x
• crontab -e
• /tmp/
• /var/tmp/
• /dev/shm/
• /etc/cron.d/
• /etc/systemd/system/
• authorized_keys

What your security team should do

• Treat affected Pandora FMS instances as high priority due to weaponized exploit maturity and very high EPSS probability.
• Immediately inventory all Pandora FMS deployments, including appliances, containers, virtual machines, and test instances.
• Upgrade all installations running versions 700 through 777.4 to a fixed release newer than 777.4 or the latest supported vendor release.
• Restrict Pandora FMS Console access to trusted administrative sources and remove direct internet exposure wherever possible.
• Temporarily disable LDAP authentication if it is not operationally required until the system is patched and validated.
• Search web, application, authentication, proxy, EDR, and system logs for command-injection patterns targeting Pandora FMS authentication paths.
• Assume secrets accessible to the Pandora FMS application may be exposed if exploitation indicators are found; rotate those credentials after containment.
• Check for persistence on the Pandora FMS host, including unexpected web files, cron entries, systemd services, reverse shells, and new user accounts.
• Monitor outbound connections from Pandora FMS servers for unusual DNS, HTTP, HTTPS, SSH, or raw TCP callbacks.
• Add SIEM detections for suspicious shell metacharacters and encoded command execution syntax in requests to Pandora FMS login or LDAP authentication workflows.