CVE-2023-7315
📋 TL;DR
Nagios XI versions before 5.11.3 contain a cross-site scripting vulnerability in the Graph Explorer component. Attackers can inject malicious scripts that execute in victims' browsers when they view manipulated graphs. Organizations using Nagios XI for monitoring are affected.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Session hijacking, credential theft, or defacement of monitoring interfaces by authenticated attackers.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy headers in place.
🎯 Exploit Status
Requires user interaction; victim must view manipulated graph. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.11.3
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/
Restart Required: No
Instructions:
1. Backup current configuration. 2. Download Nagios XI 5.11.3 from Nagios website. 3. Follow upgrade instructions in documentation. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Disable Graph Explorer
allTemporarily disable the vulnerable Graph Explorer component to prevent exploitation.
Navigate to Admin > System Config > Manage Components > Disable Graph Explorer
Implement CSP Headers
allAdd Content Security Policy headers to restrict script execution sources.
Add 'Content-Security-Policy: script-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict access to Nagios XI web interface using network segmentation and firewall rules.
- Implement web application firewall (WAF) rules to block XSS payloads in Graph Explorer requests.
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via Admin > System Config > About. If version is below 5.11.3, system is vulnerable.Check Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
After upgrade, verify version shows 5.11.3 or higher. Test Graph Explorer functionality with safe test inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual Graph Explorer parameter values in web server logs
- Multiple failed Graph Explorer requests from single IP
Network Indicators:
- HTTP requests to Graph Explorer with script tags or JavaScript in parameters
SIEM Query:
source="web_access.log" AND uri="/nagiosxi/graph_explorer" AND (param="script" OR param="javascript")