CVE-2019-15949: Nagios XI Remote Code Execution Vulnerability
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes checkplugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the checkplugin executable and insert malicious commands to execute as root.
Other sources
Nagios XI contains a remote code execution vulnerability in which a user can modify the checkplugin executable and insert malicious commands to execute as root.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nagios XIto a version that resolves this vulnerability.Fixed in 5.6.6 - Configuration
Remove the passwordless sudo entry that allows getprofile.sh (invoked by profile.php?cmd=download) to be executed as root.
sudoers passwordless sudo for getprofile.sh = remove - Configuration
Ensure the check_plugin executable cannot be modified by the nagios user or by web users who can modify plugins (for example, change ownership to root and remove write permissions for the nagios user).
Nagios XI check_plugin executable ownership/permissions = not writable by nagios user - Configuration
Revoke or restrict plugin-upload/modify privileges so only trusted administrator accounts that require this capability can modify plugins.
Nagios XI web interface plugin modification permission = restrict to trusted administrators only - Compensating control
Restrict access to the Nagios XI web interface and management functionality to trusted IPs or networks (for example via firewall rules, VPN, or network ACLs) to reduce exposure of admin accounts.
Event History
Frequently Asked Questions
What is CVE-2019-15949?
CVE-2019-15949 is a vulnerability in Nagios XI that allows remote code execution as root.
What is the severity of CVE-2019-15949?
The severity of CVE-2019-15949 is critical with a CVSS score of 8.8.
How does CVE-2019-15949 work?
CVE-2019-15949 can be exploited by accessing the server as the nagios user or as the admin user via the web interface to execute arbitrary commands as root.
Which versions of Nagios XI are affected by CVE-2019-15949?
Nagios XI versions up to and excluding 5.6.6 are affected by CVE-2019-15949.
How can CVE-2019-15949 be fixed?
To fix CVE-2019-15949, users should update to Nagios XI version 5.6.6 or higher.