CVE-2024-12971

What it actually does

This vulnerability is an OS command injection flaw in Pandora FMS versions 700 through 777.6. A vulnerable component fails to properly neutralize shell metacharacters or command separators before using attacker-controlled input in an operating system command. Successful exploitation can allow an attacker to execute arbitrary commands with the privileges of the Pandora FMS web application or service account. Depending on deployment permissions, this may lead to remote code execution, file creation or modification, credential theft, lateral movement, persistence, and full compromise of the monitoring server.

Why it matters to the business

Pandora FMS often has broad visibility into infrastructure, credentials, agents, alerts, and operational telemetry. Compromise of the monitoring platform can therefore affect many connected systems, disrupt monitoring and alerting, expose sensitive infrastructure data, and provide an attacker with a high-value foothold for wider intrusion. The CVSS score is high, EPSS is elevated, and exploit maturity is listed as weaponized, so organizations running affected versions should treat this as an urgent remediation priority even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed Pandora FMS instance and determines that it is running a vulnerable version between 700 and 777.6. The attacker then sends a crafted request to the vulnerable functionality containing shell metacharacters, command separators, or command substitution syntax. Because the application does not safely neutralize the supplied input before passing it to the operating system, the injected payload is interpreted as part of a system command. Initial payloads commonly validate execution using harmless commands such as whoami, id, hostname, or DNS/HTTP callbacks. Once confirmed, the attacker may download tools, establish a reverse shell, read configuration files, steal credentials or API tokens, alter monitoring data, create persistence, and pivot to systems monitored or administered through Pandora FMS.

How to fix it

Upgrade Pandora FMS to a vendor-fixed release newer than the affected range of 700 through 777.6, or to the latest supported version available from the vendor. If immediate upgrade is not possible, restrict access to the Pandora FMS web interface to trusted administrative networks or VPNs, enforce strong authentication and MFA where supported, block direct internet exposure, and apply compensating controls through a web application firewall that detects command-injection patterns. Review and reduce the privileges of the Pandora FMS service account, remove unnecessary shell access, rotate credentials stored or used by Pandora FMS after patching, and harden outbound network access from the monitoring server to limit payload retrieval and callback channels.

How to confirm the fix worked

Confirm that no Pandora FMS installation is running a version from 700 through 777.6. Validate the installed version using the product interface, package manager, vendor upgrade records, or application files. After upgrading, repeat authenticated and unauthenticated exposure checks to ensure the vulnerable build is no longer present. If a WAF or reverse proxy mitigation is used temporarily, test that requests containing command separators, command substitution syntax, and common shell payload patterns are blocked or sanitized. Confirm that the Pandora FMS web interface is not publicly reachable unless explicitly required and that only trusted administrative sources can access it.

Typical attack path

1. Discover internet-facing or internally reachable Pandora FMS web interfaces.
2. Fingerprint the application version or infer exposure based on response behavior.
3. Send crafted input containing command-injection metacharacters to the vulnerable function.
4. Confirm command execution using process output, timing behavior, or an outbound DNS/HTTP callback.
5. Execute reconnaissance commands under the Pandora FMS service or web server account.
6. Read application configuration files and credentials accessible to the service account.
7. Deploy a web shell, reverse shell, scheduled task, cron job, or other persistence mechanism.
8. Use stolen credentials or network reachability from the monitoring server to move laterally.
9. Tamper with logs, alerts, or monitoring data to hide activity.

How to detect it

To determine whether exploitation already occurred, review web server, reverse proxy, WAF, and Pandora FMS application logs for requests containing shell metacharacters, command separators, command substitution syntax, encoded payloads, or suspicious parameters followed by unusual server behavior. Correlate suspicious HTTP requests with host telemetry showing web server or Pandora FMS processes spawning shells or command-line utilities. On Linux, review process execution logs, auditd, syslog, authentication logs, shell history where available, cron directories, systemd unit files, /tmp, /var/tmp, web-accessible directories, and outbound DNS/HTTP connections. Look for child processes such as sh, bash, curl, wget, python, perl, nc, socat, openssl, or busybox launched by apache, httpd, nginx, php-fpm, pandora, or other Pandora FMS-related service accounts. Investigate creation of unexpected PHP files, modified application files, new administrator accounts, new SSH keys, unfamiliar scheduled jobs, and outbound connections shortly after suspicious web requests. Because exploitation may be weaponized, also search for short-lived reconnaissance commands such as id, whoami, uname, hostname, env, ip addr, ifconfig, cat /etc/passwd, and attempts to retrieve second-stage payloads.

• ;/bin/sh
• ; /bin/sh
• ;/bin/bash
• ; /bin/bash
• && /bin/sh
• && /bin/bash
• |/bin/sh
• | /bin/sh
• `id`
• $(id)
• `whoami`
• $(whoami)
• `uname -a`
• $(uname -a)
• cat /etc/passwd
• curl http://
• curl https://
• wget http://
• wget https://
• bash -c
• sh -c
• python -c
• perl -e
• php -r
• nc -e
• ncat -e
• socat TCP
• /dev/tcp/
• chmod +x /tmp/
• chmod +x /var/tmp/
• /tmp/.
• /var/tmp/.
• crontab -e
• /etc/cron.d/
• /etc/systemd/system/
• authorized_keys
• php-fpm
• apache2
• httpd
• nginx
• pandora

What your security team should do

• Prioritize patching or upgrading all Pandora FMS instances running versions 700 through 777.6 because exploitation is assessed as weaponized and EPSS is elevated.
• Immediately inventory internet-facing Pandora FMS deployments and restrict administrative access to trusted networks.
• Hunt for evidence of command execution from web server or Pandora FMS service processes, especially child shells and network download utilities.
• Review Pandora FMS configuration files, stored credentials, integrations, and API tokens for possible exposure; rotate secrets after remediation.
• Inspect the host for unauthorized files, web shells, cron jobs, systemd units, scheduled tasks, new users, SSH keys, and suspicious outbound connections.
• Add SIEM detections for command-injection metacharacters in Pandora FMS HTTP requests and for shell processes spawned by web application services.
• If compromise is suspected, isolate the monitoring server, preserve logs and forensic artifacts, and perform credential rotation before restoring normal connectivity.