/CVE-2024-24401

Auto exploitation tool for CVE-2024-24401.

Primary LanguagePython

Vulnerability Report

CVE Disovered by: Jarod Jaslow (MAWK)

(DESIGNED TO BE RUN ON KALI LINUX)

Notes

Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1.

The updated script checks to make sure that the target system is vulnerable

OVA NAGIOS USER CREDS: mawk:mawk

DOWNLOAD: https://1drv.ms/u/s!Aj-SNbxrSxWZh51fp476lHxNHGd6jA?e=AX3mJU

image

Vulnerability Details:

  • Endpoint: /nagiosxi//config/monitoringwizard.php Nagios XI Version 2024R1.0.1
  • Vulnerability Type: Authenticated SQL Injection
  • Exploitation Result: Admin account creation and full remote code execution

Steps to Reproduce:

  1. Create a fresh instance of Nagios XI Version 2024R1.01. Pasted image 20240118113507

Pasted image 20240118113528

Pasted image 20240118113539

Pasted image 20240118113554

  1. Create a user with minimum permissions. Pasted image 20240118113548

  2. Execute the provided Python script with the correct arguments:

    python3 MawkiNagiosXIPOC.py <target IP>

image

image

Proof of Concept:

Attached is the Python script demonstrating the vulnerability

Recommendation:

To mitigate the risk of SQL injection, it is strongly advised to use parameterized queries or prepared statements when interacting with databases. Parameterized queries ensure that user input is treated as data, not executable code, making it much more difficult for attackers to inject malicious SQL statements.

This is mitigated in recent updates

CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-24401

image