CVE-2021-25298

What it actually does

Nagios XI 5.7.5 contains an authenticated OS command injection flaw in the Cloud VM configuration wizard at /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. The vulnerable code passes user-controlled HTTP request data into an operating-system command without sufficient sanitization, allowing a logged-in attacker to append shell metacharacters or commands. Successful exploitation can execute arbitrary commands on the Nagios XI server with the privileges of the web application or associated Nagios service account, potentially leading to credential theft, configuration tampering, lateral movement, or full server compromise.

Why it matters to the business

A compromised Nagios XI server is high impact because it commonly has visibility into many critical systems, stores monitoring credentials, and may be trusted by infrastructure teams. Attackers can use this flaw to disrupt monitoring, hide outages or intrusions, steal credentials and host data, pivot to monitored assets, or deploy tooling from a central operations platform. This vulnerability is listed in CISA KEV with a remediation deadline of 2022-02-01 and has active in-the-wild exploitation indicators, so any remaining exposure should be treated as urgent even though the issue is older.

How an attack unfolds

An attacker first obtains valid Nagios XI credentials, often through phishing, password reuse, stolen session cookies, or compromise of a low-privileged account. After authenticating to the Nagios XI web interface, the attacker sends a crafted HTTP request to the Cloud VM configuration wizard endpoint. Malicious input containing shell command separators or command substitution syntax is processed by cloud-vm.inc.php and incorporated into an OS command. The injected command then runs on the Nagios XI server, allowing the attacker to test execution with simple commands, download a web shell or reverse shell payload, enumerate local files and credentials, modify Nagios configuration, and use the monitoring server as a foothold for lateral movement. Public exploitation and KEV status mean defenders should assume opportunistic scanning and post-authentication exploitation attempts may exist against internet-facing or weakly protected Nagios XI deployments.

How to fix it

Upgrade Nagios XI from affected version 5.7.5 to a vendor-supported fixed release, preferably the latest available Nagios XI version. If immediate upgrade is not possible, remove or disable the Cloud VM configuration wizard, restrict access to the Nagios XI web interface to trusted administrative networks or VPN only, enforce strong MFA and least-privilege access for Nagios XI users, and monitor or block requests to the vulnerable config wizard path. Rotate Nagios XI application credentials, API keys, service account passwords, and any infrastructure credentials stored in or accessible from Nagios XI if exploitation is suspected. Because this issue is in CISA KEV and the remediation deadline has long passed, prioritize full remediation over compensating controls.

How to confirm the fix worked

Confirm that no Nagios XI system is running version 5.7.5 and that all instances are on a vendor-supported fixed release. Review the filesystem to verify whether the vulnerable Cloud VM wizard file still exists and whether its package version has been replaced by the upgraded release. From an authenticated low-privileged test account in a non-production or approved testing window, confirm that crafted inputs containing shell metacharacters are rejected, sanitized, or do not result in command execution. Validate that the Nagios XI web interface is not publicly reachable unless explicitly required and protected by compensating controls. Review web server, Nagios XI audit, and system logs for historical access to the vulnerable wizard endpoint before declaring the issue fully resolved.

Typical attack path

1. Identify an exposed Nagios XI instance and confirm the version or presence of the Cloud VM configuration wizard.
2. Obtain or reuse valid Nagios XI credentials for any account with access to the vulnerable wizard flow.
3. Send a crafted authenticated HTTP request to the cloud-vm configuration wizard containing shell metacharacters or command substitution syntax.
4. Execute a benign command such as id, whoami, uname, or curl to confirm command execution.
5. Run follow-on commands to download payloads, create persistence, harvest Nagios credentials and configuration files, or open a reverse shell.
6. Use credentials, host inventories, scripts, or trust relationships from the monitoring server to pivot further into the environment.
7. Tamper with monitoring checks, notifications, or logs to reduce detection of the intrusion.

How to detect it

Check for prior exploitation by correlating Nagios XI application logs, web server access/error logs, authentication logs, shell history, process execution telemetry, EDR events, and outbound network telemetry from the Nagios XI server. Primary log sources include Apache or httpd access logs such as /var/log/httpd/access_log, /var/log/httpd/ssl_access_log, /var/log/apache2/access.log, Nagios XI audit and subsystem logs under /usr/local/nagiosxi/var/, system authentication logs such as /var/log/secure or /var/log/auth.log, cron directories, and EDR process trees. Hunt for authenticated POST or GET requests to the Cloud VM configuration wizard path containing shell metacharacters, URL-encoded separators, command substitution, or common command-execution probes such as whoami, id, uname, curl, wget, bash, sh, nc, perl, or python. Investigate web server child processes spawning shells or network utilities, unexpected outbound connections from the Nagios XI server, new files under web-accessible directories, unexpected changes to Nagios configuration, new local users or SSH keys, and deleted or truncated logs. Because exploitation requires authentication, also review successful logins immediately before suspicious wizard requests, especially from unusual source IPs, new geographies, or accounts that do not normally administer Nagios XI.

• /nagiosxi/includes/configwizards/cloud-vm/
• cloud-vm.inc.php
• /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php
• configwizards/cloud-vm
• %3bwhoami
• %3bid
• %3buname
• %7cwhoami
• %7cid
• %7cuname
• %26%26whoami
• %26%26id
• %24%28whoami%29
• %24%28id%29
• `whoami`
• `id`
• ;curl
• ;wget
• |curl
• |wget
• bash -c
• sh -c
• /dev/tcp/
• nc -e
• python -c
• perl -e
• /var/log/httpd/access_log
• /var/log/httpd/ssl_access_log
• /var/log/apache2/access.log
• /usr/local/nagiosxi/var/

What your security team should do

• Immediately inventory all Nagios XI deployments and identify any instance running version 5.7.5 or otherwise containing the vulnerable Cloud VM wizard code.
• Patch or upgrade affected Nagios XI systems to the latest supported release as the top priority due to KEV listing and high EPSS likelihood.
• Restrict Nagios XI administrative access to trusted networks, VPN, or privileged access management paths; do not expose the web interface broadly to the internet.
• Review all Nagios XI accounts for unnecessary access, enforce MFA where supported, and reset passwords for accounts that could access configuration wizards.
• Hunt historical web logs for authenticated requests to /nagiosxi/includes/configwizards/cloud-vm/ and suspicious command-injection characters or payloads.
• Inspect the Nagios XI server for unexpected processes, web shells, cron jobs, SSH keys, outbound connections, downloaded tools, and modified monitoring configurations.
• Rotate credentials stored in Nagios XI or used by Nagios plugins if there is any evidence of exploitation.
• Create SIEM detections for requests to the Cloud VM wizard path containing shell metacharacters, URL-encoded command separators, or download-and-execute patterns.