CVE-2020-28910
📋 TL;DR
This vulnerability in Nagios XI 5.7.5 and earlier allows local attackers to escalate privileges by exploiting insecure temporary directory permissions in getprofile.sh. Attackers can create symbolic links that lead to privilege escalation when the script executes. This affects all Nagios XI installations running vulnerable versions.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing complete control over the Nagios server and potentially lateral movement to other systems.
Likely Case
Local privilege escalation from a low-privileged user to root, enabling installation of backdoors, data theft, and further system manipulation.
If Mitigated
Limited impact if proper file permissions and access controls prevent unauthorized users from accessing the system or creating symlinks.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7.6 and later
Vendor Advisory: https://www.nagios.com/downloads/nagios-xi/change-log/
Restart Required: No
Instructions:
1. Backup your Nagios XI configuration. 2. Download the latest version from Nagios website. 3. Follow the upgrade instructions in the Nagios XI documentation. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Secure Temporary Directory Permissions
linuxManually secure the temporary directory permissions to prevent symlink attacks
chmod 700 /tmp/nagiosxi_profile_tmp
chown root:root /tmp/nagiosxi_profile_tmp
🧯 If You Can't Patch
- Restrict local user access to the Nagios server to only authorized administrators
- Implement strict file integrity monitoring on the getprofile.sh script and temporary directories
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version: cat /usr/local/nagiosxi/var/xiversionCheck Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 5.7.6 or higher and check that getprofile.sh script has been updated📡 Detection & Monitoring
Log Indicators:
- Unusual symlink creation in /tmp directories
- Multiple failed privilege escalation attempts
- Suspicious activity from non-admin users in Nagios logs
Network Indicators:
- Unusual outbound connections from Nagios server post-exploitation
SIEM Query:
source="nagios" AND (event="symlink_creation" OR event="privilege_escalation_attempt")🔗 References
- http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
- https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/
- https://www.nagios.com/downloads/nagios-xi/change-log/
- http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html
- https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/
- https://www.nagios.com/downloads/nagios-xi/change-log/
