CVE-2021-25298
Nagios XI OS Command Injection
Description
CVE-2021-25298 is a high-severity OS command injection vulnerability in Nagios XI version 5.7.5. The vulnerability exists in the cloud-vm configuration wizard (cloud-vm.inc.php) due to improper sanitization of authenticated user-controlled input, allowing an attacker to inject and execute arbitrary operating system commands on the Nagios XI server through a single HTTP request. CISA has added CVE-2021-25298 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 78.37% (99.0th percentile), this Nagios XI command injection vulnerability presents a very high probability of exploitation and requires urgent patching.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| nagios | nagios xi | >= 5.5.6, <= 5.7.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://assets.nagios.com/downloads/nagiosxi/versions.php(Product)
- https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md(Exploit, Third Party Advisory)
- https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25298(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
OS Command Injection occurs when software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2021-25298, the Nagios XI cloud-vm configuration wizard incorporates user-supplied input into OS commands without adequate sanitization, enabling authenticated attackers to inject shell metacharacters and execute arbitrary commands with the privileges of the Nagios XI web application.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2021-25298 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a serious security risk for organizations running Nagios XI. The vulnerability is remotely exploitable over the network with low attack complexity and requires only low-level authentication to exploit. No user interaction is necessary for a successful attack. Confidentiality (High): Successful exploitation enables attackers to execute commands that read sensitive files, dump credentials, access database contents, and exfiltrate monitoring configurations from the Nagios XI server. Integrity (High): Attackers can use injected commands to modify system configurations, create backdoor accounts, alter monitoring thresholds to suppress alerts, and install persistent malware. Availability (High): Command injection allows attackers to terminate monitoring processes, delete critical data, and disrupt the availability of the Nagios XI platform. The EPSS score of 78.37% places this vulnerability in the 99.0th percentile, indicating a very high probability of exploitation. Since Nagios XI typically has broad network visibility for monitoring purposes, a compromised instance provides attackers with valuable intelligence about the organization’s infrastructure.
Exploit Maturity
CVE-2021-25298 has a well-established exploit ecosystem with multiple public resources available. Public exploit code is available via Packet Storm Security and detailed in a Fastly technical analysis with Metasploit module. Additional exploit documentation is available in the GitHub advisory. CISA has confirmed active exploitation by listing this vulnerability in the KEV catalog with a remediation deadline of 2022-02-01. The EPSS score of 78.37% (99.0th percentile) indicates a very high probability of exploitation. CVE-2021-25298 is the third in a set of three related Nagios XI command injection vulnerabilities (CVE-2021-25296, CVE-2021-25297, CVE-2021-25298), each targeting a different configuration wizard endpoint in version 5.7.5, giving attackers multiple paths to achieve command execution on a vulnerable server.
Remediation
- Apply updates immediately as required by CISA KEV. Upgrade Nagios XI beyond version 5.7.5 to a patched release that addresses the command injection vulnerabilities across all configuration wizard components.
- Verify that all Nagios XI deployments are running versions newer than 5.7.5. Affected versions range from 5.5.6 through 5.7.5.
- Implement network-level access controls to restrict access to the Nagios XI web interface. Use firewall rules to limit connectivity to trusted management subnets only, reducing the attack surface for this authenticated vulnerability.
- Review and harden Nagios XI user accounts by enforcing least-privilege access, removing unused accounts, and requiring strong authentication. Even low-privileged authenticated users can exploit the cloud-vm configuration wizard to achieve command execution.
- Enable comprehensive logging and monitoring on the Nagios XI server. Watch for unusual process spawning, unexpected network connections, anomalous HTTP requests to configuration wizard endpoints (particularly cloud-vm.inc.php), and file integrity changes. Deploy host-based intrusion detection to catch post-exploitation activity.
Technical Details
CVE-2021-25298 is an OS command injection vulnerability in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php within Nagios XI version 5.7.5. The cloud-vm configuration wizard accepts user-controlled input through HTTP request parameters and passes it to operating system command execution functions without adequate sanitization or escaping of shell metacharacters. An authenticated attacker can inject characters such as semicolons, pipes, backticks, or command substitution expressions to break out of the intended command context and execute arbitrary OS commands on the server. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network-based exploitability with low complexity, low privilege requirements, and complete impact on confidentiality, integrity, and availability. The root cause is CWE-78 (OS Command Injection), where the application constructs shell commands through string concatenation of user input rather than using safe parameterized execution interfaces that separate commands from their arguments.
Frequently Asked Questions
Is CVE-2021-25298 being actively exploited?
Yes. CVE-2021-25298 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available through multiple sources including Packet Storm Security and a Metasploit module. The EPSS score of 78.37% further indicates a very high probability of exploitation.
What products are affected by CVE-2021-25298?
CVE-2021-25298 affects Nagios XI versions 5.5.6 through 5.7.5. The vulnerability is in the cloud-vm configuration wizard component (cloud-vm.inc.php). It is the third of three related command injection vulnerabilities (CVE-2021-25296, CVE-2021-25297, CVE-2021-25298) affecting Nagios XI 5.7.5 through different configuration wizard files.
How do I fix CVE-2021-25298?
Upgrade Nagios XI to a version newer than 5.7.5 that includes patches for the command injection vulnerabilities. As interim measures, restrict network access to the Nagios XI web interface, enforce strict user account policies, and monitor for suspicious command execution activity.
How severe is CVE-2021-25298?
CVE-2021-25298 has a CVSS 3.1 score of 8.8 (HIGH). It allows authenticated remote attackers to execute arbitrary OS commands on the Nagios XI server. With an EPSS score of 78.37% (99.0th percentile), exploitation probability is very high, and multiple public exploits are available.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.