CVE-2022-50587
📋 TL;DR
Nagios XI versions before 5.8.9 contain a stored cross-site scripting vulnerability in the Apply Configuration error text. Attackers can inject malicious scripts that execute in victims' browsers when viewing configuration errors. This affects all Nagios XI administrators and users who access the monitoring interface.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Session hijacking of Nagios administrators, credential theft, or defacement of monitoring interface.
If Mitigated
Limited to script execution in browser context with proper content security policies and input validation.
🎯 Exploit Status
Requires authenticated access to inject payload into configuration error text.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8.9
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/
Restart Required: No
Instructions:
1. Backup current configuration. 2. Download Nagios XI 5.8.9 or later. 3. Follow upgrade instructions from Nagios documentation. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for configuration error text fields
Content Security Policy
allImplement strict CSP headers to limit script execution
🧯 If You Can't Patch
- Restrict access to Nagios XI interface to trusted users only
- Implement web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via Admin > System Config > About pageCheck Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 5.8.9 or later and test configuration error handling📡 Detection & Monitoring
Log Indicators:
- Unusual configuration error messages with script tags
- Multiple failed configuration apply attempts
Network Indicators:
- HTTP requests with script payloads in configuration parameters
SIEM Query:
source="nagios" AND ("script" OR "javascript" OR "onerror") AND "applyconfig"