CVE-2002-1211 in Prometheus
Summary
by MITRE
Prometheus 6.0 and earlier allows remote attackers to execute arbitrary PHP code via a modified PROMETHEUS_LIBRARY_BASE that points to code stored on a remote server, which is then used in (1) index.php, (2) install.php, or (3) various test_*.php scripts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2025
The vulnerability described in CVE-2002-1211 represents a critical remote code execution flaw in Prometheus 6.0 and earlier versions that stems from insecure input handling and dynamic code inclusion mechanisms. This vulnerability allows remote attackers to execute arbitrary PHP code by manipulating the PROMETHEUS_LIBRARY_BASE environment variable to point to malicious code hosted on a remote server. The flaw exists in multiple core scripts including index.php, install.php, and various test_*.php files, creating multiple attack vectors that significantly expand the exploitation surface.
The technical implementation of this vulnerability involves a dangerous combination of variable substitution and dynamic file inclusion patterns within the PHP application. When the PROMETHEUS_LIBRARY_BASE variable is modified to reference external resources, the application fails to validate or sanitize the input before using it in file inclusion operations. This creates a classic path traversal and remote code execution scenario where attacker-controlled content can be executed as PHP code. The vulnerability directly maps to CWE-434 which describes insecure file upload and download scenarios, and CWE-94 which covers inadequate input validation leading to code injection vulnerabilities.
The operational impact of this vulnerability is severe as it provides attackers with complete remote code execution capabilities on affected systems. Once exploited, attackers can execute arbitrary commands, gain persistent access, escalate privileges, and potentially compromise the entire server infrastructure. The vulnerability affects the installation and operational phases of the application, making it particularly dangerous as it can be exploited during both initial setup and normal operation. This represents a critical security risk that could lead to data breaches, system compromise, and unauthorized access to sensitive information stored within the Prometheus environment.
The attack vector leverages the principle of insecure parameter handling and dynamic code loading, enabling attackers to bypass normal security controls through manipulation of application configuration variables. This vulnerability demonstrates the importance of input validation and secure coding practices in preventing remote code execution scenarios. Organizations using affected versions should immediately implement mitigations including updating to patched versions, implementing proper input validation for environment variables, and restricting network access to the application. The vulnerability also highlights the need for regular security assessments and the importance of following secure coding guidelines such as those outlined in the OWASP Top Ten and NIST cybersecurity frameworks. Additionally, this vulnerability aligns with ATT&CK technique T1059.007 which covers scripting languages and T1078.004 which addresses legitimate credentials used for persistence, as exploitation would likely involve both code execution and potential credential manipulation.