HIGH

CVE-2021-25297

Nagios Nagios Xi 2021-02-15 CVSS v3.1

CVSS

8.8

KEV

Description

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Summary dbcve.org

Nagios XI version 5.7.5 contains an OS command injection vulnerability in the switch configuration wizard component (switch.inc.php). The vulnerability stems from improper sanitization of authenticated user-controlled input passed through a single HTTP request, allowing an authenticated attacker to inject and execute arbitrary OS commands on the server.

Mitigation

Upgrade to a patched version of Nagios XI; alternatively, sanitize/validate all user input in the affected switch.inc.php file using strict allowlist validation and escape shell metacharacters before passing data to system calls.

Proof of Concept

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

56.66%

Probability of exploitation in next 30 days

99th percentile

References

http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry https://assets.nagios.com/downloads/nagiosxi/versions.php Product https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md Exploit, Third Party Advisory https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25297 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE