CVE-2023-37154

What it actually does

check_by_ssh permits injection of arbitrary commands into SSH configuration options (ProxyCommand, LocalCommand, PermitLocalCommand) by abusing ${IFS} word-splitting to bypass argument parsing and execute attacker-controlled code with the privileges of the Nagios process.

Why it matters to the business

Attackers can gain full control of the monitoring host, allowing them to disable alerting, steal credentials, move laterally into monitored systems, and disrupt operational visibility for extended periods.

How an attack unfolds

An attacker with the ability to influence Nagios service check definitions or plugin arguments crafts a malicious check_by_ssh invocation that embeds command fragments using ${IFS} inside SSH config directives; when the plugin executes, the shell expands the IFS variables and runs the injected commands instead of the intended SSH connection.

How to fix it

Upgrade nagios-plugins to the commit e8810de21be80148562b7e0168b0a62aeedffde6 or later; where immediate upgrade is impossible, restrict check_by_ssh usage to trusted hosts only and remove the plugin from any untrusted check definitions.

How to confirm the fix worked

Confirm the installed nagios-plugins tree contains commit e8810de21be80148562b7e0168b0a62aeedffde6; run the check_by_ssh binary against a test target containing ${IFS} in a ProxyCommand argument and verify the command is rejected rather than executed.

Typical attack path

1. Identify a Nagios deployment using an unpatched nagios-plugins package
2. Obtain write access to service definitions or the ability to trigger custom checks
3. Construct a check_by_ssh command line containing ProxyCommand or LocalCommand with ${IFS} payload
4. Trigger the check via Nagios scheduler or manual execution
5. Obtain shell access or code execution on the Nagios host

How to detect it

Search Nagios logs and command history for check_by_ssh invocations containing ProxyCommand, LocalCommand, or PermitLocalCommand together with dollar-brace IFS sequences; inspect process execution logs for unexpected shell commands spawned by the nagios user.

• check_by_ssh.*ProxyCommand.*\$\{IFS
• check_by_ssh.*LocalCommand.*\$\{IFS
• check_by_ssh.*PermitLocalCommand.*\$\{IFS

What your security team should do

• Apply the fixed commit e8810de21be80148562b7e0168b0a62aeedffde6 to all Nagios monitoring hosts within 30 days
• Audit existing service checks for any use of check_by_ssh with user-supplied arguments
• Add the plugin to a deny-list for external or low-trust hosts until patched
• Monitor for new EPSS or KEV updates given the 737-day disclosure window