CVE-2019-15949
HIGH KEVNagios XI < 5.6.6 - Authenticated Remote Command Execution via getprofile.sh
Title source: llmExploitation Summary
CVE-2019-15949 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 6 public exploits from researchers including Metasploit, Calil Khalil, plur1bu5, including a Metasploit module auxiliary/scanner/http/nagios_xi_scanner.
AI-analyzed exploit summary This Metasploit module exploits CVE-2019-15949 in Nagios XI before 5.6.6 to achieve authenticated remote command execution as root by uploading a malicious plugin and triggering its execution via a system profile download request.
Description
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
Exploits (6)
This Metasploit module exploits CVE-2019-15949 in Nagios XI before 5.6.6 to achieve authenticated remote command execution as root by uploading a malicious plugin and triggering its execution via a system profile download request.
This exploit leverages an authenticated file upload vulnerability in Nagios XI to achieve remote code execution by uploading a malicious plugin disguised as 'check_ping'. The payload establishes a reverse shell to the attacker's specified IP and port.
This repository contains a functional Python exploit for CVE-2019-15949, which leverages a privilege escalation vulnerability in Nagios XI <= 5.6.5. The exploit uploads a malicious plugin via the web interface and triggers it to achieve root RCE.
This Metasploit module scans Nagios XI installations to detect their version and suggests matching exploit modules based on the version number. It requires authentication or a manually provided version to function.
This repository contains a functional Python exploit for CVE-2019-15949, an authenticated remote code execution vulnerability in Nagios XI. The exploit authenticates to the target, uploads a malicious plugin, and executes a reverse shell payload.
This Metasploit module exploits an authenticated RCE vulnerability in Nagios XI prior to 5.6.6 by uploading a malicious 'check_ping' plugin via the monitoring plugins interface and executing it through a GET request to the profile download endpoint.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H