CVE-2022-50585
📋 TL;DR
This cross-site scripting (XSS) vulnerability in Nagios XI's Core Config Manager allows attackers to inject malicious scripts into the Audit Log page search input. When exploited, these scripts execute in victims' browsers, potentially stealing session cookies or performing actions as the victim. Organizations running Nagios XI versions before CCM 3.1.7 / Nagios XI 5.8.9 are affected.
💻 Affected Systems
- Nagios XI
- Nagios Core Config Manager (CCM)
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals administrator session cookies, gains full administrative access to Nagios XI, and potentially compromises the entire monitoring infrastructure or uses it as a pivot point to attack other systems.
Likely Case
Attacker steals user session cookies to gain unauthorized access to Nagios XI, potentially modifying monitoring configurations or accessing sensitive system information.
If Mitigated
Script execution is blocked by browser security features or web application firewalls, limiting impact to minor UI disruption.
🎯 Exploit Status
Exploitation requires the attacker to trick an authenticated user into visiting a specially crafted Audit Log page URL. The vulnerability is in the search input field on the Audit Log page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nagios XI 5.8.9 or CCM 3.1.7
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/
Restart Required: No
Instructions:
1. Log into Nagios XI as administrator. 2. Navigate to Admin > Updates. 3. Click 'Check for Updates'. 4. If update to 5.8.9+ is available, click 'Update'. 5. Follow on-screen instructions to complete the update.
🔧 Temporary Workarounds
Input Validation via WAF
allConfigure web application firewall to filter or block malicious script patterns in search parameters
Content Security Policy
allImplement strict CSP headers to prevent inline script execution
🧯 If You Can't Patch
- Restrict access to Nagios XI Audit Log page to trusted users only
- Implement network segmentation to isolate Nagios XI from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via Admin > Updates page or run: grep 'nagios_version' /usr/local/nagiosxi/var/xiversionCheck Version:
grep 'nagios_version' /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 5.8.9 or higher, or CCM version is 3.1.7 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual search patterns in Nagios XI audit logs containing script tags or JavaScript
- Multiple failed login attempts followed by Audit Log access
Network Indicators:
- HTTP requests to Audit Log page with encoded script payloads in search parameters
SIEM Query:
source="nagios_xi" AND (url="*auditlog*" AND (search="*<script*" OR search="*javascript:*" OR search="*onerror=*"))