CVE-2021-47693
📋 TL;DR
This SQL injection vulnerability in Nagios XI's Core Config Manager allows authenticated users to inject malicious SQL queries through search text fields. Successful exploitation could lead to unauthorized access, data disclosure, or modification of configuration data. Organizations running Nagios XI versions before 5.8.5 are affected.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Nagios XI database, leading to unauthorized access to all monitoring data, configuration manipulation, and potential lateral movement to other systems.
Likely Case
Unauthorized disclosure or modification of Nagios configuration data, potentially affecting monitoring capabilities and exposing sensitive infrastructure information.
If Mitigated
Limited impact due to proper input validation, database permissions restrictions, and network segmentation.
🎯 Exploit Status
Exploitation requires authenticated access but uses simple SQL injection techniques against known vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nagios XI 5.8.5 or Core Config Manager 3.1.3
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/
Restart Required: Yes
Instructions:
1. Backup current Nagios XI configuration and database. 2. Download Nagios XI 5.8.5 or later from Nagios customer portal. 3. Follow Nagios XI upgrade documentation. 4. Restart Nagios XI services after upgrade.
🔧 Temporary Workarounds
Input Validation Filter
allImplement additional input validation for search parameters in Core Config Manager
Not applicable - requires code modification
Database Permission Restriction
linuxRestrict database user permissions to minimum required for Nagios XI operations
GRANT SELECT, INSERT, UPDATE, DELETE ON nagios.* TO 'nagiosuser'@'localhost';
REVOKE DROP, CREATE, ALTER ON nagios.* FROM 'nagiosuser'@'localhost';
🧯 If You Can't Patch
- Restrict access to Nagios XI web interface to trusted IP addresses only
- Implement web application firewall (WAF) rules to detect and block SQL injection attempts
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via Admin > System Status > Version Information in web interfaceCheck Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 5.8.5 or later and Core Config Manager is 3.1.3 or later📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful login and search activity
- Long or unusual search parameters in web server logs
Network Indicators:
- Unusual database connections from Nagios XI server
- SQL error messages in HTTP responses
SIEM Query:
source="nagios_access.log" AND (uri="/nagiosxi/admin/ccm.php" OR uri="/nagiosxi/includes/components/ccm/") AND (search="*" OR param="*" OR query="*")