BugTraq
NGS000196 Technical Advisory: Nagios XI Network Monitor OS Command Injection Nov 30 2012 10:25AM
NCC Group Research (research nccgroup com)
=======
Summary
=======
Name: Nagios XI Network Monitor - OS Command Injection
Release Date: 30 November 2012
Reference: NGS00196
Discoverer: Daniel Compton <daniel.compton (at) ngssecure (dot) com [email concealed]>
Vendor: Nagios
Vendor Reference: 0000283
Systems Affected: Nagios XI Network Monitor 2011R1.9
Risk: High
Status: Published

========
TimeLine
========
Discovered: 30 January 2012
Released: 31 January 2012
Approved: 31 January 2012
Reported: 31 January 2012
Fixed: 23 May 2012
Published: 30 November 2012

===========
Description
===========
Nagios XI Network Monitor 2011R1.9 - OS Command Injection/Execution within the administrator/monitoring interface. This is a commertical product for monitoring severs and network monitoring equipment.

I. VULNERABILITY
-------------------------
Nagios XI Network Monitor 2011R1.9 suffers from OS command injection in several pages and parameters. This is exploitable as an authenticated user.

II. BACKGROUND
-------------------------
Nagios provide enterprise level network and server monitor software.

http://www.nagios.com/

III. DESCRIPTION
-------------------------
OS command injection has been found and exploited/confirmed within the software as an authenticated user. This is the latest version of Nagios XI.

=================
Technical Details
=================
IV. PROOF OF CONCEPT
-------------------------
The following URL and parameters have been confirmed to all suffer from OS command injection.

/nagiosxi/includes/components/graphexplorer/visApi.php (GET parameters:
host, service, opt, end, start)

URL:

http://192.168.1.121/nagiosxi/includes/components/graphexplorer/visApi.p
hp?type=stack&host=localhost`cat%20/etc/passwd%20>%20/tmp/passwd.txt`&se
rvice=Swap_Usage&div=visContainer1566841654&opt=days

Result: creates a new file with /etc/passwd contents.

===============
Fix Information
===============
Resolved in SVN 1.3 of Graph Explorer

http://exchange.nagios.org/directory/Addons/Components/Graph-Explorer-Co
mponent/details

CHANGES:
1.3 05/23/2012
========================
- Fixed shell vulnerabilities (reported by Daniel Compton from NGS Secure)

NCC Group Research
http://www.nccgroup.com/research

For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
This email message has been delivered safely and archived online by Mimecast.
</a>

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus