CVE-2021-47700
📋 TL;DR
Nagios XI versions before 5.8.7 use insecure permissions on a temporary directory for Highcharts exports, allowing local or co-hosted processes to read, modify, or delete exported files. This vulnerability could lead to data disclosure, tampering, or potentially code execution depending on deployment configuration. Organizations running Nagios XI versions prior to 5.8.7 are affected.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Local attackers or co-hosted processes achieve remote code execution by manipulating exported files, potentially compromising the entire Nagios XI monitoring system and monitored infrastructure.
Likely Case
Unauthorized access to sensitive monitoring data, manipulation of exported charts/reports, or denial of service by deleting critical export files.
If Mitigated
Limited to information disclosure of exported chart data if proper isolation prevents code execution.
🎯 Exploit Status
Exploitation requires local access or ability to run processes on the same host as Nagios XI. The vulnerability is straightforward to exploit once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8.7
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/
Restart Required: Yes
Instructions:
1. Backup current Nagios XI configuration and data. 2. Download Nagios XI 5.8.7 or later from the Nagios website. 3. Follow the official upgrade instructions at https://assets.nagios.com/downloads/nagiosxi/docs/Upgrading-Nagios-XI.pdf. 4. Restart Apache and Nagios services after upgrade.
🔧 Temporary Workarounds
Secure temporary directory permissions
linuxManually adjust permissions on the Highcharts temporary directory to restrict access
chmod 700 /usr/local/nagiosxi/var/components/highcharts/tmp
chown nagios:nagios /usr/local/nagiosxi/var/components/highcharts/tmp
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local access to Nagios XI server
- Isolate Nagios XI on dedicated hardware or virtual machine with no other services running
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via web interface (Admin > About) or command: grep 'fullversion' /usr/local/nagiosxi/var/xiversionCheck Version:
grep 'fullversion' /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 5.8.7 or later and check directory permissions: ls -la /usr/local/nagiosxi/var/components/highcharts/tmp📡 Detection & Monitoring
Log Indicators:
- Unauthorized file access attempts in /usr/local/nagiosxi/var/components/highcharts/tmp
- Apache error logs showing permission denied errors for Highcharts exports
Network Indicators:
- Unusual local process communication with Nagios XI server
SIEM Query:
source="apache" AND (path="*highcharts*" OR message="*permission denied*")