PT-2021-22866 · Nagios Xi · Nagios Xi

Arianeblow · Published 2021-10-26 · Updated 2022-11-08 · CVE-2021-40345

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.8.5

Description An issue was discovered in the Manage Dashlets section of the Admin panel, where an administrator can upload ZIP files. A command injection, within the name of the first file in the archive, allows an attacker to execute system commands.

Recommendations For Nagios XI version 5.8.5, consider restricting access to the Manage Dashlets section of the Admin panel to minimize the risk of exploitation. As a temporary workaround, avoid uploading ZIP files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-40345

Affected Products

Nagios Xi

References · 9

• 🔥 https://github.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.md · Exploit
• 🔥 https://synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2021-40345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40345 · Security Note
• https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT · Vendor Advisory
• https://t.me/cvenotify/22415 · Telegram Post
• https://synacktiv.com · Note
• https://t.me/cvenotify/37238 · Telegram Post
• https://t.me/cibsecurity/31199 · Telegram Post