CVE-2023-22631 in PRTG Network Monitor
Summary
by MITRE • 09/14/2026
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in PRTG Network Monitor versions prior to build 23.1.82 represents a critical security flaw within the application's web-based management interface, specifically affecting the functionality of the HTTP XML and REST sensors. These sensors are designed to allow administrators to monitor services by sending requests to external endpoints and analyzing the responses for specific data points or status codes. However, in the affected versions, the implementation fails to adequately sanitize user-supplied input when processing these sensor configurations. This lack of rigorous validation allows remote attackers who possess valid credentials or can exploit other authentication bypasses to manipulate the underlying file system operations associated with how the application handles incoming XML or REST data payloads.
The core technical flaw stems from an improper restriction on write permissions and path traversal mechanisms within the HTTP XML/REST sensor module. When a user configures such a sensor, they typically define parameters for the target URL, authentication credentials, and expected response patterns. The vulnerability arises because the application does not sufficiently validate or restrict the paths where temporary files or log entries generated during the parsing of these responses are stored. An attacker can craft a malicious HTTP request containing specially formatted XML data that includes directory traversal sequences or absolute path references. Upon processing this payload, the PRTG service writes content to arbitrary locations on the server's file system rather than restricting output to designated temporary directories with restricted permissions.
This capability for unauthorized file write operations has severe operational implications for network infrastructure security. By writing files to specific locations, an attacker can potentially overwrite critical configuration files, inject malicious scripts into web-accessible directories, or place backdoors within application-specific folders that are executed during routine monitoring tasks. If the PRTG service runs with elevated privileges, which is common in enterprise environments to ensure comprehensive network visibility, this vulnerability effectively grants the attacker a high-privilege shell on the host system. This can lead to complete compromise of the monitoring server, allowing for lateral movement across the internal network, exfiltration of sensitive network topology data stored within PRTG databases, or disruption of critical monitoring capabilities by corrupting essential application files.
From a classification perspective, this vulnerability aligns with CWE-434, which describes the unrestricted upload of file with dangerous type, and more accurately CWE-78, the OS Command Injection category if command execution is achieved through file manipulation, as well as CWE-22 for Path Traversal issues that facilitate unauthorized access to restricted directories. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1059, specifically sub-techniques involving script interpretation or system commands executed via compromised services. The attack vector is classified under Remote Code Execution through application layer vulnerabilities, leveraging the trusted relationship between the monitoring agent and its configuration interface.
Mitigation strategies must prioritize immediate patching to version 23.1.82 or later, where these input validation checks have been hardened. In environments where patching cannot be implemented immediately due to operational constraints, network segmentation should be enforced to restrict access to the PRTG web interface exclusively from trusted administrative subnets. Additionally, implementing strict file integrity monitoring on directories associated with PRTG operations can help detect unauthorized write attempts in real-time. It is also advisable to review sensor configurations regularly to ensure that no custom scripts or external integrations are relying on insecure parsing behaviors, and to enforce the principle of least privilege by ensuring the application service account operates with minimal necessary file system permissions.