CVE-2021-47690
📋 TL;DR
This cross-site scripting vulnerability in Nagios XI's Core Config Manager allows attackers to inject malicious scripts into overlay modals. When exploited, these scripts execute in victims' browsers, potentially stealing session cookies or performing actions as the user. Organizations running Nagios XI versions before 5.8.2 or CCM before 3.1.1 are affected.
💻 Affected Systems
- Nagios XI
- Nagios Core Config Manager (CCM)
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals administrator session cookies, gains full administrative access to Nagios XI, and potentially compromises the monitoring infrastructure and monitored systems.
Likely Case
Attacker steals user session cookies to gain unauthorized access to Nagios XI, potentially modifying monitoring configurations or accessing sensitive system information.
If Mitigated
Script execution is blocked by browser security features or web application firewalls, limiting impact to minor UI disruption.
🎯 Exploit Status
Exploitation requires user interaction (victim must visit malicious link or page) and authentication to Nagios XI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nagios XI 5.8.2 or CCM 3.1.1
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/
Restart Required: No
Instructions:
1. Backup current Nagios XI installation. 2. Download Nagios XI 5.8.2 or later from Nagios customer portal. 3. Follow Nagios XI upgrade documentation. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd Content Security Policy headers to restrict script execution sources
Add 'Content-Security-Policy: script-src 'self'' to web server configuration
Web Application Firewall Rules
allConfigure WAF to detect and block XSS payloads in overlay modal parameters
🧯 If You Can't Patch
- Restrict Nagios XI access to trusted users only using network segmentation
- Implement strong session management with short timeouts and secure cookie attributes
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via Admin > System Config > About page or run: cat /usr/local/nagiosxi/var/xiversionCheck Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 5.8.2 or higher and check that overlay modals properly escape user input📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript in HTTP request parameters to overlay endpoints
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests containing script tags or JavaScript in overlay modal parameters
SIEM Query:
source="web_server_logs" AND (uri="*overlay*" OR uri="*modal*") AND (message="*<script>*" OR message="*javascript:*")