New Nagios Software Bugs Could Let Hackers Take Over IT Infrastructures

guest · Sep 22, 2021

New Nagios Software Bugs Could Let Hackers Take Over IT Infrastructures
September 22, 2021
https://thehackernews.com/2021/09/new-nagios-software-bugs-could-let.html

As many as 11 security vulnerabilities have been disclosed in Nagios network management systems, some of which could be chained to achieve pre-authenticated remote code execution with the highest privileges, as well as lead to credential theft and phishing attacks.

Industrial cybersecurity firm Claroty, which discovered the flaws, said flaws in tools such as Nagios make them an attractive target owing to their "oversight of core servers, devices, and other critical components in the enterprise network." The issues have since been fixed in updates released in August with Nagios XI 5.8.5 or above, Nagios XI Switch Wizard 2.5.7 or above, Nagios XI Docker Wizard 1.13 or above, and Nagios XI WatchGuard 1.4.8 or above.
Click to expand...

Chief among the issues are two remote code execution flaws (CVE-2021-37344, CVE-2021-37346) in Nagios XI Switch Wizard and Nagios XI WatchGuard Wizard, an SQL injection vulnerability (CVE-2021-37350) in Nagios XI, and a server-side request forgery (SSRF) affecting Nagios XI Docker Wizard, as well as a post-authenticated RCE in Nagios XI's Auto-Discovery tool. The complete list of 11 flaws is as follows - [...]
Click to expand...

guest · Oct 13, 2021

Nagios XI updated to address trio of security vulnerabilities
Post-auth flaws could give attackers a platform from which to pivot to other parts of the network
October 13, 2021
https://portswigger.net/daily-swig/nagios-xi-updated-to-address-trio-of-security-vulnerabilities

Three vulnerabilities have been addressed in Nagios XI, which monitors mission-critical enterprise infrastructure components.

Nagios XI monitors applications, services, operating systems, network protocols, systems metrics, and network infrastructure, and has privileged access to network and server configuration and reporting.
Researchers at the Synopsys Cybersecurity Research Center discovered medium-severity SQL injection, path traversal, and cross-site scripting (XSS) vulnerabilities that could be exploited by authenticated attackers.
Click to expand...

‘Tempting target’
“ An attacker would need an initial foothold in the system through which to target them, which is why they have a ‘medium’ rating in the advisory,” Scott Tolley, the Synopsys security engineer who discovered the vulnerabilities, tells The Daily Swig.

“However, the nature of network monitoring software such as Nagios is that is has privileged access to a lot of assets on the target network. That makes them a very tempting target for attackers looking to pivot to other parts of an already compromised system.”
Click to expand...

The first flaw, CVE-2021-33177, allows an authenticated user with access to the bulk modifications tool, such as admin, to inject arbitrary SQL into an UPDATE statement. In the default configuration, this allows execution of arbitrary PostgreSQL functions.

Meanwhile, a path traversal vulnerability in the NagVis reporting module (CVE-2021-33178) allows an attacker with access to the NagVis ManageBackgrounds endpoint, such as admin, to delete arbitrary files on the server limited by the rights of the Apache server effective user.
Finally, a reflected XSS on the core config manager (CVE-2021-33179) could enable a malicious URL to execute arbitrary JavaScript code in the victim’s browser and surface local session data from Nagios XI.
Click to expand...

Log in or Sign up

New Nagios Software Bugs Could Let Hackers Take Over IT Infrastructures

guest Guest

guest Guest

Log in or Sign up

New Nagios Software Bugs Could Let Hackers Take Over IT Infrastructures

guest Guest

guest Guest

Useful Searches