Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Tactical RMM allows unauthorized users with report management permissions to access sensitive information, including system secrets, and potentially execute commands on managed devices. The core issue stems from how the system processes user-supplied report templates, enabling an arbitrary file read that compromises critical credentials and operational control.
- Sensitive data and commands accessible to unauthorized users.
- High impact management platform vulnerability.
- Confirm relevance and exposure of this system.
Attack Path
How an attacker could exploit the issue
An attacker with report management permissions can exploit this vulnerability by crafting a malicious template that includes a file path pointing to sensitive system files. When this template is processed by the reporting preview endpoint, the underlying library attempts to read the specified file and embed its contents into a PDF report. This allows the attacker to potentially read critical configuration files, such as the Django SECRET_KEY, which can then be used to publish arbitrary commands to managed agents across the network.
- Authenticated user with report management access.
- Request to `/reporting/templates/preview/` with crafted `template_md`.
- Remote code execution on managed agents.
Live Threat
Current exploitation, exposure, and threat context
A user with report management permission could exploit this vulnerability to read sensitive system configuration data, including a Django SECRET_KEY which is also used as a NATS password. This exposure could occur when the system generates a report preview, allowing the embedded files to be read.
- System secrets and credentials.
- Reading user-supplied template files.
- Arbitrary command execution on managed agents.
Operational Fix
Recommended remediation, mitigation, and detection steps
The immediate focus should be on identifying where Tactical RMM is deployed, assessing its exposure, and locating the system owners. Given the arbitrary file read vulnerability enabling command execution, this requires a swift inventory of affected systems, confirmation of their business criticality and network reachability, and the identification of the accountable application or infrastructure teams to initiate a targeted remediation plan based on the assessed risk.
- Identify affected Tactical RMM deployments.
- Confirm network exposure and business criticality.
- Plan and execute risk-based remediation.
