Security News > 2021 > May > Details Disclosed On Critical Flaws Affecting Nagios IT Monitoring Software

Cybersecurity researchers disclosed details about 13 vulnerabilities in the Nagios network monitoring application that could be abused by an adversary to hijack the infrastructure without any operator intervention.

Put differently; the attack scenario works by targeting a Nagios XI server at the customer site, using CVE-2020-28648 and CVE-2020-28910 to gain RCE and elevate privileges to "Root." With the server now effectively compromised, the adversary can then send tainted data to the upstream Nagios Fusion server that's used to provide centralized infrastructure-wide visibility by periodically polling the Nagios XI servers.

The researchers have also published a PHP-based post-exploitation tool called SoyGun that chains the vulnerabilities together and "Allows an attacker with Nagios XI user's credentials and HTTP access to the Nagios XI server to take full control of a Nagios Fusion deployment."

CVE-2020-28901 - Nagios Fusion privilege escalation from apache to nagios via command injection on component dir parameter in cmd subsys.

CVE-2020-28902 - Nagios Fusion privilege escalation from apache to nagios via command injection on timezone parameter in cmd subsys.

CVE-2020-28908 - Nagios Fusion privilege escalation from apache to nagios via command injection in cmd subsys.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/VgTYVbIPz7I/details-disclosed-on-critical-flaws.html