CVE-2024-54960
📋 TL;DR
A SQL injection vulnerability in Nagios XI 2024R1.2.2 allows remote attackers to execute arbitrary SQL commands via crafted payloads in the History Tab component. This could lead to unauthorized data access, modification, or deletion. Organizations running Nagios XI 2024R1.2.2 are affected.
💻 Affected Systems
- Nagios XI
📦 What is this software?
Nagios Xi by Nagios
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized access to monitoring data, configuration information, and potential privilege escalation within Nagios.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details available in GitHub repository. Requires authentication to Nagios XI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024R1.2.3 or later
Vendor Advisory: https://www.nagios.com/downloads/nagios-xi/change-log/
Restart Required: Yes
Instructions:
1. Backup current Nagios XI installation. 2. Download latest version from Nagios website. 3. Run upgrade script. 4. Restart Nagios services.
🔧 Temporary Workarounds
Input Validation Enhancement
linuxImplement additional input validation for History Tab parameters
# Requires code modification - implement parameterized queries in affected PHP files
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns
# Example ModSecurity rule: SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Restrict network access to Nagios XI administration interface
- Implement strict database user permissions with least privilege principle
🔍 How to Verify
Check if Vulnerable:
Check Nagios XI version via Admin > System Config > About. If version is 2024R1.2.2, system is vulnerable.Check Version:
grep 'nagios_version' /usr/local/nagiosxi/var/xiversionVerify Fix Applied:
Verify version is 2024R1.2.3 or later and test History Tab functionality with SQL injection test payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by History Tab access
- SQL syntax errors in web server logs
Network Indicators:
- Unusual database connections from web server
- SQL keywords in HTTP POST parameters to History Tab
SIEM Query:
source="apache.log" AND (uri="/nagiosxi/admin/history.php" OR uri="/nagiosxi/includes/components/history/") AND (message="*SELECT*" OR message="*UNION*" OR message="*INSERT*")