CVE-2019-15949
Nagios XI Remote Code Execution Vulnerability
Description
CVE-2019-15949 is a high-severity remote code execution vulnerability in Nagios XI before version 5.6.6. The vulnerability allows an authenticated attacker to execute arbitrary commands as root by modifying the check_plugin executable, which is invoked with root privileges through a passwordless sudo entry when downloading a system profile. CISA has added CVE-2019-15949 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 88.6% (99.5th percentile), this Nagios XI vulnerability represents one of the most likely-to-be-exploited vulnerabilities in the threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nagios | nagios xi | < 5.6.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156676/Nagios-XI-Authenticated-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/162158/Nagios-XI-getprofile.sh-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/jakgibb/nagiosxi-root-rce-exploit(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15949(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection')
CWE-78 describes OS command injection vulnerabilities where user-controlled input is incorporated into operating system commands without proper sanitization. In CVE-2019-15949, the Nagios XI platform allows users with plugin modification permissions to alter the check_plugin executable, which is subsequently executed as root through a sudo-enabled script. This effectively allows injection of arbitrary commands that run with the highest system privileges.
Learn more: CWE-78 — Improper Neutralization of Special Elements Used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2019-15949 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a severe security risk to organizations running Nagios XI. The vulnerability is exploitable over the network with low attack complexity and requires only low-level privileges (authenticated access to the Nagios XI web interface), with no user interaction needed. Confidentiality (High): An attacker gaining root access can read all sensitive data on the monitoring server, including credentials for monitored hosts, SNMP community strings, and database contents. Integrity (High): Root-level command execution allows the attacker to modify system configurations, tamper with monitoring data, and install persistent backdoors. Availability (High): Full system control enables the attacker to disrupt monitoring services, potentially masking further attacks on the monitored infrastructure. The EPSS score of 88.6% places this vulnerability in the 99.5th percentile, indicating near-certain exploitation activity.
Exploit Maturity
CVE-2019-15949 has well-established exploit maturity with multiple public exploits available. Public exploit code is available via Packet Storm Security (authenticated RCE) and Packet Storm Security (getprofile.sh RCE), as well as a dedicated exploit repository on GitHub. CISA has confirmed active exploitation in the wild through its Known Exploited Vulnerabilities catalog listing. The EPSS score of 88.6% (99.5th percentile) indicates near-certain exploitation, making this one of the most actively targeted vulnerabilities. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade Nagios XI to version 5.6.6 or later, which addresses the privilege escalation through the check_plugin execution path.
- Audit all Nagios XI instances to confirm the running version and ensure no instances remain on versions prior to 5.6.6. Pay particular attention to systems that may have been deployed without centralized management.
- Review and restrict user permissions in Nagios XI, particularly the ability to modify plugins. Limit plugin modification rights to only the absolutely necessary administrative accounts, and implement role-based access controls.
- Implement network segmentation to isolate Nagios XI monitoring servers from general network access, restricting web interface access to authorized management networks only. Monitor for unusual command execution patterns, unexpected file modifications to check_plugin, and anomalous sudo usage in system logs.
- Conduct a thorough review of the Nagios XI server for indicators of compromise, including unauthorized modifications to check_plugin or other executables, unexpected cron jobs, new user accounts, and suspicious network connections, as the public availability of multiple exploits increases the likelihood of prior exploitation.
Technical Details
CVE-2019-15949 exploits a privilege escalation chain in Nagios XI before version 5.6.6. The attack leverages the getprofile.sh script, which is invoked when a user downloads a system profile via profile.php with the cmd=download parameter. This script is configured to execute with root privileges through a passwordless sudo entry in the system's sudoers configuration. Critically, getprofile.sh calls the check_plugin executable, which is owned by the nagios user rather than root. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that any authenticated user with plugin modification permissions, or an attacker who has gained access as the nagios system user, can replace or modify check_plugin to contain arbitrary commands that will subsequently execute as root when the system profile download is triggered. This represents a classic OS command injection (CWE-78) through an insecure privilege boundary where a root-executed script trusts input from a lower-privileged user-writable file.
Frequently Asked Questions
Is CVE-2019-15949 being actively exploited?
Yes. CVE-2019-15949 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. Multiple public exploits are available on Packet Storm Security and GitHub, and the EPSS score of 88.6% (99.5th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2019-15949?
CVE-2019-15949 affects Nagios XI versions prior to 5.6.6. All installations running earlier versions are vulnerable to authenticated remote code execution as root through the check_plugin privilege escalation chain.
How do I fix CVE-2019-15949?
Upgrade Nagios XI to version 5.6.6 or later. Additionally, restrict plugin modification permissions to essential administrative accounts only and implement network segmentation to limit access to the Nagios XI web interface.
How severe is CVE-2019-15949?
CVE-2019-15949 has a CVSS 3.1 score of 8.8 (HIGH). The combination of authenticated remote code execution with root privileges, multiple public exploits, and an EPSS score in the 99.5th percentile makes this a critical-priority vulnerability requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.