CVE-2022-50588
📋 TL;DR
Nagios XI versions before 5.8.9 contain a stored cross-site scripting vulnerability in the update checking feature. Attackers can inject malicious scripts that execute in victims' browsers when they view the update page. Organizations running Nagios XI versions below 5.8.9 are affected.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Attackers with access to the Nagios XI interface could inject malicious scripts that execute when administrators check for updates, potentially stealing credentials or session data.
If Mitigated
With proper input validation and output encoding, the script injection would be prevented, limiting impact to error messages or benign display issues.
🎯 Exploit Status
Exploitation requires access to the Nagios XI interface and knowledge of the update checking feature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8.9
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/
Restart Required: No
Instructions:
1. Backup your Nagios XI configuration. 2. Download Nagios XI 5.8.9 or later from the Nagios website. 3. Follow the official upgrade instructions for your deployment method. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Update Checking
allTemporarily disable the update checking feature to prevent exploitation while planning an upgrade.
Edit Nagios XI configuration to disable automatic update checks
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution
- Use web application firewall rules to block XSS payloads in update-related requests
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via the web interface or command line. If version is below 5.8.9, the system is vulnerable.Check Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
After upgrading, verify the version is 5.8.9 or higher and test the update checking feature for proper input validation.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript payloads in update-related requests
- Multiple failed update check attempts with suspicious parameters
Network Indicators:
- HTTP requests containing script tags or JavaScript in update checking parameters
SIEM Query:
source="nagios" AND (url="*update*" OR url="*check*update*") AND (content="<script>" OR content="javascript:")