CVE-2020-35578

HIGH

Nagios XI < 5.8.0 - OS Command Injection

Title source: rule

Description

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.

Exploits (2)

exploitdb WORKING POC

by Haboob Team · pythonwebappsphp

https://www.exploit-db.com/exploits/49422

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by Haboob Team, Erik Wynter · rubypoclinux

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb

View Code ZIP pw:eip

References (4)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/160948/Nagios-XI-5.7.x-Remote-Code-Execution.html

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/162207/Nagios-XI-Remote-Code-Execution.html

[Release Notes, Vendor Advisory] https://www.nagios.com/downloads/nagios-xi/change-log/

[Vendor Advisory] https://www.nagios.com/products/security/

Scores

CVSS v3 7.2

EPSS 0.8520

EPSS Percentile 99.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (1)

nagios/nagios_xi < 5.8.0

Published Jan 13, 2021

Tracked Since Feb 18, 2026