CVE-2021-3273
📋 TL;DR
This vulnerability allows authenticated Nagios XI administrators to execute arbitrary code through code injection in the graphtemplates.php component. Attackers with admin credentials can compromise the Nagios XI server. Only Nagios XI installations below version 5.7 with admin accounts are affected.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands, access sensitive monitoring data, and pivot to other systems in the network.
Likely Case
Attackers with stolen admin credentials could execute arbitrary code to install backdoors, exfiltrate monitoring data, or disrupt monitoring operations.
If Mitigated
With proper access controls and admin account security, impact is limited to authorized administrators only.
🎯 Exploit Status
Exploit requires admin credentials but is straightforward once authenticated. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7 and above
Vendor Advisory: https://www.nagios.com/downloads/nagios-xi/change-log/
Restart Required: No
Instructions:
1. Backup current Nagios XI configuration. 2. Download Nagios XI 5.7 or later from Nagios website. 3. Follow Nagios XI upgrade documentation. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Admin Access
linuxLimit admin account access to trusted IP addresses only
# Configure web server (Apache/nginx) to restrict /nagiosxi/admin/ to specific IPs
# Example Apache: Require ip 192.168.1.0/24
Disable Unused Admin Accounts
allRemove or disable unnecessary admin accounts
# Nagios XI admin interface: Admin > Manage Users > Edit/Delete unused admin accounts
🧯 If You Can't Patch
- Implement strict admin account policies with strong passwords and MFA
- Monitor admin account activity and restrict access to Nagios XI admin interface
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via web interface (Help > About) or command line: cat /usr/local/nagiosxi/var/xiversionCheck Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 5.7 or higher and test admin functionality remains working📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /nagiosxi/admin/graphtemplates.php
- Admin account logins from unusual locations/times
- System command execution in web server logs
Network Indicators:
- Unexpected outbound connections from Nagios XI server
- Unusual traffic patterns to admin interface
SIEM Query:
source="web_access.log" AND uri="/nagiosxi/admin/graphtemplates.php" AND (method="POST" OR status>=400)