Friday, December 1, 2023

13 Vulnerabilities in Nagios Server Let Hackers Compromises The IT Infrastructure

Nagios is popular open-source software that is mainly used for monitoring computer systems and IT networks, but, recently, 13 critical vulnerabilities were detected in Nagios XI and Nagios Fusion servers by the security analysts at Skylight Cyber.

The exploitation of these vulnerabilities could allow an attacker to compromise an IT network of an organization without any intervention of the operator.

However, Nagios gets a report regarding the privilege escalation flaws as well as the authenticated remote code execution (RCE) in October 2020, and later Nagios has rectified the flaws in November 2020.

Detecting a vulnerability is not that easy, but the security researchers at Skylight Cyber have claimed that they have identified these 13 vulnerabilities in just one day.

The analysts are now trying to find such vulnerabilities, that will eventually help them in compromising the very large Nagios deployment.

But apart from all these things, the initial requirement is the set of vulnerabilities and exploits to compromise the large Nagios deployment, and here they are mentioned below:-

  • Using an RCE & Privilege Escalation an attacker needs to gain the root-level code execution on the Nagios XI server at the negotiated site of the customer.
  • To trigger an XSS, simply taint the data that has been returned to the Nagios Fusion.
  • To negotiate the Nagios Fusion server that is using an RCE and Priv. Esc. simply an attacker has to use the session that triggered the XSS.
  • To exploit the “fused” XI servers at the remaining customer sites, an attacker has to gain all the credentials.

PoC or Attack Platform

Once you are done with collecting all the vulnerability and exploits then you are fully ready to compromise this huge Nagios attack. 

However, for the Nagios Fusion/XI deployment the security analysts have stated some PoCs that help in compromising the huge attack. That’s why the researchers have built a full-fledged attack manifesto and named it as SoyGun to compromise this attack.


SoyGun is a PHP-based post-exploitation tool that is quite flexible in nature and enables the threat actors to take complete control over Nagios Fusion deployment, with the credentials and HTTP access of Nagios XI user’s to the Nagios XI server.

While the SoyGun is filled with 4 key components, and here they are mentioned below:-

  • Command & Control (C2)
  • Implant
  • Payload
  • DeadDrop

Command & Control (C2)

This is the very first step for starting the SoyGun, as it consists of CLI and along with that it also has the Command & Control source for the exploited servers.

It is generally used to collect all the exploited Fusion and XI servers of Nagios so that every user can get to their explored deployment easily.  

SoyGun Implant

SoyGun Implant is another key component, that is used as a root on all the exploited servers of Nagios Fusion/XI. However, it is filled with complete data of the exploitation, and it also consists of a DeadDrop code.

While the SoyGun was developed due to limited connectivity between Fusion and XI servers only the essential network connections are allowed.

Full vulnerabilities list

  • CVE-2020-28903 – XSS in Nagios XI when the attacker has control over the fused server.
  • CVE-2020-28905 – Nagios Fusion authenticated remote code execution (from the context of the low-privileges user).
  • CVE-2020-28902 – Nagios Fusion privilege escalation from apache to Nagios via command injection on timezone parameter in cmd_subsys.php.
  • CVE-2020-28901 – Nagios Fusion privilege escalation from apache to Nagios via command injection on component_dir parameter in cmd_subsys.php.
  • CVE-2020-28904 – Nagios Fusion privilege escalation from apache to Nagios via the installation of the malicious component.
  • CVE-2020-28900 – Nagios Fusion and XI privilege escalation from nagios to root via
  • CVE-2020-28907 – Nagios Fusion privilege escalation from apache to root via and modification of proxy config.
  • CVE-2020-28906 – Nagios Fusion and XI privilege escalation from nagios to root via modification of fusion-sys.cfg / xi-sys.cfg.
  • CVE-2020-28909 – Nagios Fusion privilege escalation from Nagios to root via modification of scripts that can execute as sudo.
  • CVE-2020-28908 – Nagios Fusion privilege escalation from apache to Nagios via command injection (caused by poor sanitization) in cmd_subsys.php.
  • CVE-2020-28911 – Nagios Fusion information disclosure – low privileges the user can discover passwords used to authenticate to fused servers.
  • CVE-2020-28648 – Nagios XI authenticated remote code execution (from the context of the low-privileges user).
  • CVE-2020-28910 – Nagios XI privilege escalation.

These vulnerabilities could badly impact all the users of the targeted organizations since the attackers could exploit these critical vulnerabilities in the supply chain attacks.

That’s why cybersecurity analysts have affirmed that sophisticated attackers can easily discover and exploit these vulnerabilities in the architecture of Nagios, and can disrupt the IT network and internal systems of any targeted organization.


Latest articles

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

Zyxel Command Injection Flaws Let Attackers Run OS Commands

Three Command injection vulnerabilities have been discovered in Zyxel NAS (Network Attached Storage) products,...

North Korean Hackers Attacking macOS Using Weaponized Documents

Hackers often use weaponized documents to exploit vulnerabilities in software, which enables the execution...

Most Popular Websites Still Allow Users To Have Weak Passwords

The latest analysis shows that tens of millions of people are creating weak passwords...

Chrome Zero-Day Vulnerability That Exploited In The Wild

Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles