CVE-2024-13992
📋 TL;DR
Nagios XI versions before 2024R1.1 contain a reflected cross-site scripting (XSS) vulnerability in the 404 error page. An attacker can craft malicious links that execute arbitrary JavaScript in victims' browsers when they visit the Nagios XI missing page. This affects all Nagios XI administrators and users who might click on crafted links.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
Nagios Xi by Nagios
Nagios Xi by Nagios
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could steal session cookies, perform actions as the victim user (including administrative actions), or redirect to phishing pages within the Nagios XI context.
Likely Case
Session hijacking leading to unauthorized access to monitoring data, configuration changes, or privilege escalation within Nagios XI.
If Mitigated
Limited impact with proper session management, CSP headers, and user awareness about suspicious links.
🎯 Exploit Status
Exploitation requires user interaction (victim must click malicious link) and knowledge of Nagios XI URL structure. No authentication bypass needed for the XSS itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024R1.1
Vendor Advisory: https://www.nagios.com/changelog/nagios-xi/2024r1-1/
Restart Required: No
Instructions:
1. Backup current Nagios XI installation. 2. Download Nagios XI 2024R1.1 from Nagios customer portal. 3. Follow upgrade instructions in documentation. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Input Validation Enhancement
allAdd input validation to page-missing.php to sanitize URL parameters before displaying them.
Modify /usr/local/nagiosxi/html/includes/page-missing.php to properly escape user input using htmlspecialchars() or similar functions
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Educate users about not clicking suspicious links to Nagios XI
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via Admin > System Config > About. If version is earlier than 2024R1.1, system is vulnerable.Check Version:
cat /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
After upgrade, verify version shows 2024R1.1 or later. Test by attempting to inject script tags via missing page URL parameters.📡 Detection & Monitoring
Log Indicators:
- Unusual 404 requests with script tags or JavaScript in URL parameters
- Multiple failed page requests from single IP with suspicious parameters
Network Indicators:
- HTTP requests to /nagiosxi/includes/page-missing.php with encoded script payloads in query strings
SIEM Query:
source="nagios_access.log" AND uri="/includes/page-missing.php" AND (query CONTAINS "<script>" OR query CONTAINS "javascript:")