I want to make sure that a remote code execution (RCE) of a UNC path on the PRTG core server system with the security context of the PRTG core server service (CVE-2020-10374) is not possible until I can update to PRTG versions as of PRTG 20.1.57.
How can I mitigate CVE-2020-10374 until I can update?
Modified on 2025-06-10 15:44:21 +0200
Attention: This article is a record of a conversation with the Paessler support team. The information in this conversation is not updated to preserve the historical record. As a result, some of the information or recommendations in this conversation might be out of date.
Disclaimer:
The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
What CVE-2020-10374 is about
With a carefully crafted POST request, a possible attacker can perform an RCE by executing a UNC path on the PRTG core server system with the security context of the PRTG core server service, without the need of an authenticated session.
By utilizing the what parameter of the screenshot function that is used in the Contact Support form in PRTG, for example, an attacker is able to inject a crafted, URI-compatible UNC path that is executed as part of the caller chain down to the Chromium engine to create the screenshot.
How to mitigate CVE-2020-10374
To mitigate the security issue, you have the following options.
Option 1: Web application firewall
If you have a web application firewall (WAF), you can block HTTP POST and GET requests that contain the what parameter, or you can delete or overwrite the what parameter.
Note: This process differs depending on the WAF you use. For detailed instructions, please refer to the respective product’s documentation.
Option 2: No web application firewall
If you do not have a WAF and if you do not need to generate any PDF reports for PRTG until you can update to the latest PRTG version, go to C:\Program Files (x86)\PRTG Network Monitor\Sensor System and rename the file reporter.exe to break the calling chain of the attack vector.
Note: This does not affect any major PRTG functionality. Generating screenshots and PDF reports, however, will not be possible until the PRTG update.
Mar, 2020 - Permalink