CVE-2024-43199
📋 TL;DR
This CVE describes a local privilege escalation vulnerability in Nagios NDOUtils where certain executable files are owned by the nagios user instead of root. An attacker with access to the nagios user account can exploit this to gain root privileges on the system. This affects Nagios installations using NDOUtils versions before 2.1.4.
💻 Affected Systems
- Nagios NDOUtils
📦 What is this software?
Ndoutils by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root access, allowing attacker to install persistent backdoors, access all data, and pivot to other systems.
Likely Case
Privilege escalation from nagios user to root, enabling complete control over the Nagios monitoring system and potentially other services on the host.
If Mitigated
Limited to nagios user privileges only, preventing system-wide compromise.
🎯 Exploit Status
Exploitation requires existing access to the nagios user account. The vulnerability is straightforward to exploit once nagios user access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.4
Vendor Advisory: https://github.com/NagiosEnterprises/ndoutils/commit/18ef12037f4a68772d6840cbaa08aa2da07d2891
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download NDOUtils 2.1.4 from Nagios repository. 3. Stop Nagios service. 4. Install/upgrade to version 2.1.4. 5. Verify file ownership is corrected. 6. Restart Nagios service.
🔧 Temporary Workarounds
Manual file permission correction
linuxManually change ownership of vulnerable executable files from nagios user to root
sudo chown root:root /usr/local/nagios/bin/ndo*
sudo chmod 755 /usr/local/nagios/bin/ndo*
🧯 If You Can't Patch
- Restrict access to the nagios user account and monitor for unauthorized access attempts
- Implement strict file integrity monitoring on NDOUtils executable files
🔍 How to Verify
Check if Vulnerable:
Check if NDOUtils executable files are owned by nagios user: ls -la /usr/local/nagios/bin/ndo* | grep nagiosCheck Version:
ndo2db -V | grep versionVerify Fix Applied:
Verify files are owned by root: ls -la /usr/local/nagios/bin/ndo* | grep root📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation attempts
- Changes to file ownership in /usr/local/nagios/bin/
- Unusual activity by nagios user
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
source="system_logs" AND (event="chown" OR event="setuid") AND user="nagios" AND target_file="*/ndo*"