CVE-2021-36365
📋 TL;DR
CVE-2021-36365 is a critical privilege escalation vulnerability in Nagios XI where the repairmysql.sh script has incorrect file permissions. This allows any local user to execute arbitrary commands with root privileges. All Nagios XI installations before version 5.8.5 are affected.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise - attacker gains root access, can install persistent backdoors, exfiltrate all monitoring data, and pivot to other systems.
Likely Case
Local privilege escalation leading to full control of the Nagios XI server, potentially allowing modification of monitoring configurations and access to credentials.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized local access to the Nagios XI server.
🎯 Exploit Status
Exploitation requires local access to the Nagios XI server. The vulnerability is simple to exploit once an attacker has any level of local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8.5
Vendor Advisory: https://www.nagios.com/downloads/nagios-xi/change-log/
Restart Required: No
Instructions:
1. Backup your Nagios XI configuration and data. 2. Download Nagios XI 5.8.5 or later from the official Nagios website. 3. Follow the upgrade instructions in the Nagios XI documentation. 4. Verify the fix by checking file permissions on repairmysql.sh.
🔧 Temporary Workarounds
Fix file permissions manually
linuxManually change the permissions of repairmysql.sh to remove world-writable access
chmod 750 /usr/local/nagiosxi/scripts/repairmysql.sh
chown root:root /usr/local/nagiosxi/scripts/repairmysql.sh
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into the Nagios XI server locally
- Monitor for unauthorized access attempts and file permission changes on repairmysql.sh
🔍 How to Verify
Check if Vulnerable:
Check if repairmysql.sh is world-writable: ls -la /usr/local/nagiosxi/scripts/repairmysql.sh | grep '^-rwxrwxrwx'Check Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify repairmysql.sh permissions are correct: ls -la /usr/local/nagiosxi/scripts/repairmysql.sh should show permissions like -rwxr-x---📡 Detection & Monitoring
Log Indicators:
- Unexpected execution of repairmysql.sh by non-root users
- File permission changes on repairmysql.sh
- Suspicious commands executed with root privileges
Network Indicators:
- Unusual outbound connections from Nagios XI server following local privilege escalation
SIEM Query:
source="nagios" AND (event="file_permission_change" AND file="repairmysql.sh") OR (process="repairmysql.sh" AND user!="root")