=======
Summary
=======
Name: Nagios XI Network Monitor - OS Command Injection
Release Date: 30 November 2012
Reference: NGS00196
Discoverer: Daniel Compton <daniel.compton@ngssecure.com>
Vendor: Nagios
Vendor Reference: 0000283
Systems Affected: Nagios XI Network Monitor 2011R1.9
Risk: High
Status: Published

========
TimeLine
========
Discovered: 30 January 2012
Released: 31 January 2012
Approved: 31 January 2012
Reported: 31 January 2012
Fixed: 23 May 2012
Published: 30 November 2012

===========
Description
===========
Nagios XI Network Monitor 2011R1.9 - OS Command Injection/Execution within the administrator/monitoring interface. This is a commertical product for monitoring severs and network monitoring equipment.

I. VULNERABILITY
-------------------------
Nagios XI Network Monitor 2011R1.9 suffers from OS command injection in several pages and parameters. This is exploitable as an authenticated user.

II. BACKGROUND
-------------------------
Nagios provide enterprise level network and server monitor software.

http://www.nagios.com/

III. DESCRIPTION
-------------------------
OS command injection has been found and exploited/confirmed within the software as an authenticated user. This is the latest version of Nagios XI.


=================
Technical Details
=================
IV. PROOF OF CONCEPT
-------------------------
The following URL and parameters have been confirmed to all suffer from OS command injection.

/nagiosxi/includes/components/graphexplorer/visApi.php (GET parameters:
host, service, opt, end, start)

URL:

http://192.168.1.121/nagiosxi/includes/components/graphexplorer/visApi.php?type=stack&host=localhost`cat%20/etc/passwd%20>%20/tmp/passwd.txt`&service=Swap_Usage&div=visContainer1566841654&opt=days

Result: creates a new file with /etc/passwd contents.

===============
Fix Information
===============
Resolved in SVN 1.3 of Graph Explorer

http://exchange.nagios.org/directory/Addons/Components/Graph-Explorer-Component/details

CHANGES: 
1.3 05/23/2012 
======================== 
- Fixed shell vulnerabilities (reported by Daniel Compton from NGS Secure) 

NCC Group Research
http://www.nccgroup.com/research


For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
This email message has been delivered safely and archived online by Mimecast.
</a>