CVE-2020-7943: Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like…

PriorityP260high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EXPLOIT

EPSS

7.88%

94.1th percentile

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Affected

16 ranges

Vendor	Product	Version range	Fixed in
debian	puppet	< puppetdb 7.11.2-2 (bookworm)	puppetdb 7.11.2-2 (bookworm)
debian	puppetdb	< puppetdb 7.11.2-2 (bookworm)	puppetdb 7.11.2-2 (bookworm)
debian	puppetserver	< puppetdb 7.11.2-2 (bookworm)	puppetdb 7.11.2-2 (bookworm)
puppet	puppet_enterprise	—	—
puppet	puppet_enterprise	>= 2018.1.0 < 2018.1.15	2018.1.15
puppet	puppet_enterprise	>= 2019.0 < 2019.7.0	2019.7.0
puppet	puppet_server	< 5.3.13	5.3.13
puppet	puppet_server	—	—
puppet	puppet_server	—	—
puppet	puppet_server	>= 6.0.0 < 6.11.1	6.11.1
puppet	puppetdb	< 5.2.15	5.2.15
puppet	puppetdb	—	—
puppet	puppetdb	—	—
puppet	puppetdb	>= 0 < 7.11.2-2	7.11.2-2
puppet	puppetdb	>= 0 < 7.11.2-2	7.11.2-2
puppet	puppetdb	>= 6.0.0 < 6.10.1	6.10.1

Detection & IOCsextracted from sources · hover to see the quote

url/metrics/v1/mbeans

path/pdb/dashboard/index.html

path/pdb/query/v4/facts

othertrapperkeeper

otherPuppetDB: Dashboard

→HTTP GET to /metrics/v1/mbeans returning HTTP 200 with Content-Type application/json and body containing the string 'trapperkeeper' indicates the vulnerable unauthenticated metrics endpoint is exposed.
→HTTP GET to /pdb/dashboard/index.html or /dashboard/index.html returning HTTP 200 with body containing 'PuppetDB: Dashboard' and any of 'metrics', 'population', or 'puppetdb' indicates an exposed PuppetDB dashboard.
→HTTP GET to /pdb/query/v4/facts returning HTTP 200 with Content-Type application/json and body containing 'certname', 'environment', and 'value' confirms unauthenticated PuppetDB facts API access.
→Shodan/FOFA queries can identify exposed PuppetDB dashboards on the internet for proactive hunting.

·The vulnerable /v1 metrics API is exposed to the local network by default in affected versions; fixed versions disable /v1 and restrict /v2 to localhost only. ↗
·Mitigation without patching is to disable the trapperkeeper-metrics /v1 metrics API entirely. ↗
·The /v1 endpoint leaks sensitive data including hostnames (PuppetDB), resource names/titles for defined types, function names, and class names (Puppet Server). ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

osv7.5HIGH

vendor_debian7.5LOW

vendor_redhat7.5HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.