CVE-2022-46945
📋 TL;DR
CVE-2022-46945 is an arbitrary file read vulnerability in Nagvis versions before 1.9.34. Attackers can exploit the NagVisHoverUrl.php component to read sensitive files on the server. Organizations running Nagvis for network monitoring are affected.
💻 Affected Systems
- Nagvis
📦 What is this software?
Nagvis by Nagvis
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading configuration files containing credentials, followed by lateral movement or privilege escalation.
Likely Case
Exfiltration of sensitive configuration data, credentials, or system files leading to further attacks.
If Mitigated
Limited to reading non-sensitive files if proper file permissions and network segmentation are implemented.
🎯 Exploit Status
Simple HTTP requests can trigger the vulnerability. Public exploit code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.9.34
Vendor Advisory: https://github.com/NagVis/nagvis/commit/71aba7f46f79d846e1df037f165d206a2cd1d22a
Restart Required: No
Instructions:
1. Backup current Nagvis installation. 2. Download Nagvis 1.9.34 or later from official repository. 3. Replace affected files or perform full upgrade. 4. Verify fix by checking version.
🔧 Temporary Workarounds
Restrict file access via web server
linuxConfigure web server to block access to sensitive directories and limit file read operations.
# Apache: Add to .htaccess
<Files "NagVisHoverUrl.php">
Deny from all
</Files>
# Nginx: Add to server block
location ~ /core/classes/NagVisHoverUrl\.php {
deny all;
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Nagvis from sensitive systems.
- Deploy web application firewall (WAF) with rules to block arbitrary file read patterns.
🔍 How to Verify
Check if Vulnerable:
Check Nagvis version: if below 1.9.34, system is vulnerable. Review access logs for suspicious requests to NagVisHoverUrl.php.Check Version:
grep 'define(\'CONST_VERSION\'' /path/to/nagvis/share/nagvis/includes/defines/global.php | cut -d"'" -f4Verify Fix Applied:
Confirm Nagvis version is 1.9.34 or higher. Test that file read attempts via NagVisHoverUrl.php are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /core/classes/NagVisHoverUrl.php with file path parameters
- Unusual file access patterns in web server logs
Network Indicators:
- HTTP GET requests containing file paths in parameters to Nagvis endpoints
SIEM Query:
source="web_access.log" AND url="/core/classes/NagVisHoverUrl.php" AND (param="file" OR param="path")🔗 References
- https://github.com/NagVis/nagvis/commit/71aba7f46f79d846e1df037f165d206a2cd1d22a
- https://github.com/NagVis/nagvis/compare/nagvis-1.9.33...nagvis-1.9.34
- https://www.sonarsource.com/blog/checkmk-rce-chain-3/
- https://github.com/NagVis/nagvis/commit/71aba7f46f79d846e1df037f165d206a2cd1d22a
- https://github.com/NagVis/nagvis/compare/nagvis-1.9.33...nagvis-1.9.34
- https://lists.debian.org/debian-lts-announce/2025/05/msg00000.html
- https://www.sonarsource.com/blog/checkmk-rce-chain-3/
