CVE-2018-19411 in PRTG Network Monitor
Summary
by MITRE
PRTG Network Monitor before 18.2.40.1683 allows an authenticated user with a read-only account to create another user with a read-write account (including administrator) via an HTTP request because /api/addusers doesn't check, or doesn't properly check, user rights.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/14/2020
This vulnerability exists in PRTG Network Monitor versions prior to 18.2.40.1683 and represents a critical privilege escalation flaw that undermines the application's access control mechanisms. The issue stems from insufficient authorization validation within the user management API endpoint at /api/addusers which fails to properly verify the privileges of authenticated users attempting to create new accounts. This weakness allows an attacker with a read-only user account to escalate their privileges by creating new user accounts with higher permissions, including administrator-level access. The vulnerability is particularly concerning because it directly violates the principle of least privilege and demonstrates a fundamental flaw in the application's permission model where the system does not adequately validate whether a user has the necessary authorization to perform user creation operations.
The technical implementation of this flaw occurs at the API layer where the /api/addusers endpoint lacks proper access control checks before executing user creation operations. When an authenticated user submits a request to this endpoint, the system should validate that the requesting user possesses sufficient privileges to add new users with the specified permissions. However, the vulnerable implementation either completely bypasses these checks or performs inadequate validation, allowing any authenticated user to specify administrative permissions during the user creation process. This represents a classic authorization bypass vulnerability that can be categorized under CWE-285, which specifically addresses insufficient authorization in software systems. The flaw essentially creates a backdoor mechanism within the legitimate user management interface that can be exploited by malicious actors to gain elevated privileges without proper authentication or authorization.
The operational impact of this vulnerability is severe and can lead to complete system compromise when exploited by an attacker. An authenticated user with read-only access can essentially create an administrator account and gain full control over the PRTG Network Monitor system, including access to all network monitoring data, configuration settings, and the ability to modify or delete critical system components. This vulnerability can be exploited remotely through HTTP requests, making it particularly dangerous as it does not require physical access to the system or specialized tools beyond basic web browser capabilities. The compromised system becomes vulnerable to data exfiltration, system manipulation, and potential lateral movement within the network environment. From an attacker's perspective, this represents a low-effort, high-impact attack vector that aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation through legitimate system access. The vulnerability also impacts the integrity and confidentiality of the monitoring infrastructure, potentially exposing sensitive network information to unauthorized parties.
Organizations using affected versions of PRTG Network Monitor should immediately implement several mitigation strategies to address this vulnerability. The most critical action is to upgrade to version 18.2.40.1683 or later, which includes proper access control validation for user creation operations. In the interim, administrators should implement network segmentation and firewall rules to restrict access to the PRTG API endpoints, particularly the /api/addusers endpoint, from unauthorized networks. Additionally, organizations should enforce strict user access controls and regularly audit user accounts to identify any unauthorized administrative accounts that may have been created through this vulnerability. Implementing network monitoring solutions to detect anomalous API usage patterns can also help identify exploitation attempts. Security teams should also consider implementing role-based access control policies that further limit user permissions and ensure that users with read-only access cannot perform administrative operations. The vulnerability demonstrates the importance of proper input validation and access control implementation at all levels of application architecture, reinforcing the need for comprehensive security testing and code review processes to prevent similar issues in the future.