HIGH

CVE-2021-25298

Nagios Nagios Xi 2021-02-15 CVSS v3.1

CVSS

8.8

KEV

Description

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Summary dbcve.org

Nagios XI xi-5.7.5 contains an OS command injection vulnerability in the cloud-vm configuration wizard (cloud-vm.inc.php). The vulnerability results from improper sanitization of authenticated user input before it is used in OS command execution, allowing a remote authenticated attacker to execute arbitrary commands on the underlying system.

Mitigation

Upgrade to a patched version of Nagios XI. As a temporary measure, disable the cloud-vm configuration wizard if not required, or implement input validation and use of safe API functions (escapeshellarg) for any user-supplied data before command execution.

Proof of Concept

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

75.15%

Probability of exploitation in next 30 days

99.5th percentile

References

http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry https://assets.nagios.com/downloads/nagiosxi/versions.php Product https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md Exploit, Third Party Advisory https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25298 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE