CVE-2018-8734
published 2018-04-18CVE-2018-8734: SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via…
PriorityP178critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
53.25%
98.8th percentile
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nagios | nagios_xi | >= 5.2.0 < 5.4.13 | 5.4.13 |
Detection & IOCsextracted from sources · hover to see the quote
commandcp /usr/local/nagiosxi/scripts/reset_config_perms.sh /usr/local/nagiosxi/scripts/reset_config_perms.sh.bak && echo "{cmd}" > /usr/local/nagiosxi/scripts/reset_config_perms.sh && sudo /usr/local/nagiosxi/scripts/reset_config_perms.sh && mv /usr/local/nagiosxi/scripts/reset_config_perms.sh.bak /usr/local/nagiosxi/scripts/reset_config_perms.sh↗
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI SQL Injection"; flow:established,to_server; http.uri; content:"/nagiosim.php?mode=resolve&host=|27|"; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025772; rev:2; metadata:attack_target Server, created_at 2018_07_02, cve CVE_2018_8734, deployment Datacenter, confidence High, signature_severity Critical, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI SQL Injection 2"; flow:established,to_server; http.uri; content:"/admin/helpedit.php"; fast_pattern; http.request_body; content:"selInfoKey1="; pcre:"/^[^&]+\x2527(?:UNION|SELECT)/Ri"; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025775; rev:3; metadata:attack_target Server, created_at 2018_07_03, cve CVE_2018_8734, deployment Datacenter, confidence High, signature_severity Critical, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
- →Detect SQLi exploitation attempt: POST to /nagiosql/admin/helpedit.php with 'selInfoKey1' parameter containing a URL-encoded single-quote followed by UNION or SELECT (matches ET SID 2025775 PCRE: /^[^&]+\x2527(?:UNION|SELECT)/Ri).
- →Detect auth-bypass DB user pivot: POST to /nagiosql/admin/settings.php with txtDBuser=root and txtDBpass=nagiosxi is the first step of the chained exploit.
- →Detect admin user creation via API: POST to /nagiosxi/api/v1/system/user with auth_level=admin and force_pw_change=0 using a harvested API key.
- →Detect command injection / privilege escalation: POST to /nagiosxi/backend/index.php with query parameters cmd=submitcommand and command=1111 containing shell metacharacters in command_data.
- →Monitor for modification of /usr/local/nagiosxi/scripts/reset_config_perms.sh on disk, which is overwritten with attacker-controlled content as the privilege escalation vector.
- →The SQLi payload exfiltrates API keys using the sentinel strings START_API: and :END_API in the HTTP response body; inspect responses from /nagiosql/admin/helpedit.php for these markers.
- →The exploit targets the 'selInfoKey1' POST parameter on /nagiosql/admin/helpedit.php as the SQL injection entry point per the CVE description.
- ·The SQLi parameter name differs between Nagios XI versions: 'api_key' is used for versions < 5.3.0 and 'backend_ticket' for versions >= 5.3.0; detection rules must account for both column names.
- ·The exploit resets the Nagios DB user to 'nagiosql' with password 'n@gweb' after exploitation; these are the expected default credentials and their presence in POST traffic to settings.php may indicate cleanup activity rather than initial compromise.
- ·The module targets port 80 by default (RPORT 80); deployments running Nagios XI on HTTPS/443 will not be caught by rules anchored to port 80.
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET EXPLOIT Nagios XI SQL Injection 2
suricata·2018-07-03
CVE-2018-8734 ET EXPLOIT Nagios XI SQL Injection 2
ET EXPLOIT Nagios XI SQL Injection 2
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI SQL Injection 2"; flow:established,to_server; http.uri; content:"/admin/helpedit.php"; fast_pattern; http.request_body; content:"selInfoKey1="; pcre:"/^[^&]+\x2527(?:UNION|SELECT)/Ri"; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025775; rev:3; metadata:attack_target Server, created_at 2018_07_03, cve CVE_2018_8734, deployment Datacenter, confidence High, signature_severity Critical, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET EXPLOIT Nagios XI Set DB User Root
suricata·2018-07-03
CVE-2018-8734 ET EXPLOIT Nagios XI Set DB User Root
ET EXPLOIT Nagios XI Set DB User Root
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI Set DB User Root"; flow:established,to_server; http.uri; content:"/admin/settings.php"; http.request_body; content:"txtRootPath="; content:"&txtBasePath="; content:"&selProtocol="; content:"&txtTempdir="; content:"&selLanguage="; content:"&txtEncoding="; content:"&txtDBserver="; content:"&txtDBport="; content:"&txtDBname="; content:"&txtDBuser=root"; fast_pattern; content:"&txtDBpass="; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025777; rev:2; metadata:attack_target Server, created_at 2018_07_03, cve CVE_2018_8734, deployment Datacenter, conf
Suricata
ET EXPLOIT Nagios XI Adding Administrative User
suricata·2018-07-03
CVE-2018-8734 ET EXPLOIT Nagios XI Adding Administrative User
ET EXPLOIT Nagios XI Adding Administrative User
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI Adding Administrative User"; flow:established,to_server; http.uri; content:"/api/v1/system/user"; http.request_body; content:"username="; content:"&password="; content:"&name="; content:"&email="; content:"&auth_level=admin&force_pw_change=0"; fast_pattern; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025778; rev:2; metadata:attack_target Server, created_at 2018_07_03, cve CVE_2018_8734, deployment Datacenter, confidence High, signature_severity Critical, updated_at 2020_08_25;)
Suricata
ET EXPLOIT Nagios XI Remote Code Execution 3
suricata·2018-07-03
CVE-2018-8734 ET EXPLOIT Nagios XI Remote Code Execution 3
ET EXPLOIT Nagios XI Remote Code Execution 3
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI Remote Code Execution 3"; flow:established,to_server; http.uri; content:"/index.php?cmd=submitcommand&command="; content:"&command_data=$("; fast_pattern; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025776; rev:4; metadata:attack_target Server, created_at 2018_07_03, cve CVE_2018_8734, deployment Datacenter, confidence Medium, signature_severity Critical, updated_at 2020_11_19, reviewed_at 2024_04_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Applicatio
Suricata
ET EXPLOIT FTPShell client Stack Buffer Overflow
suricata·2018-07-03
CVE-2018-8734 ET EXPLOIT FTPShell client Stack Buffer Overflow
ET EXPLOIT FTPShell client Stack Buffer Overflow
Rule: alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT FTPShell client Stack Buffer Overflow"; flow:established,to_client; content:"220|20 22|"; isdataat:400,relative; content:!"|00|"; within:400; content:!"|22|"; within:400; content:!"|0b|"; within:400; content:!"|0a|"; within:400; content:!"|0d|"; within:400; content:"|ed 2e 45 22 20|"; fast_pattern; distance:400; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-7573; reference:url,exploit-db.com/exploits/44968/; classtype:attempted-user; sid:2025779; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_07_03, cve CVE_2018_8734, deployment Perimeter, performance_i
Suricata
ET EXPLOIT Nagios XI SQL Injection
suricata·2018-07-02
CVE-2018-8734 ET EXPLOIT Nagios XI SQL Injection
ET EXPLOIT Nagios XI SQL Injection
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI SQL Injection"; flow:established,to_server; http.uri; content:"/nagiosim.php?mode=resolve&host=|27|"; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025772; rev:2; metadata:attack_target Server, created_at 2018_07_02, cve CVE_2018_8734, deployment Datacenter, confidence High, signature_severity Critical, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET EXPLOIT Nagios XI Remote Code Execution 2
suricata·2018-07-02
CVE-2018-8734 ET EXPLOIT Nagios XI Remote Code Execution 2
ET EXPLOIT Nagios XI Remote Code Execution 2
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI Remote Code Execution 2"; flow:established,to_server; http.uri; content:"/graphApi.php?host="; fast_pattern; http.uri.raw; content:"%3bsudo%20../profile/getprofile.sh%20%23"; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025773; rev:3; metadata:attack_target Server, created_at 2018_07_02, cve CVE_2018_8734, deployment Datacenter, confidence Medium, signature_severity Critical, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET EXPLOIT Nagios XI Remote Code Execution
suricata·2018-07-02
CVE-2018-8734 ET EXPLOIT Nagios XI Remote Code Execution
ET EXPLOIT Nagios XI Remote Code Execution
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Nagios XI Remote Code Execution"; flow:established,to_server; http.uri; content:"/ajaxhelper.php?cmd=getxicoreajax"; fast_pattern; http.uri.raw; content:"&opts=%7b%22func%22%3a%22get_hoststatus_table%22%7d"; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-8736; reference:url,exploit-db.com/exploits/44969/; classtype:attempted-user; sid:2025774; rev:2; metadata:attack_target Server, created_at 2018_07_02, cve CVE_2018_8734, deployment Datacenter, confidence Medium, signature_severity Critical, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_
Exploit-DB
Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)
exploitdb·2018-07-02
CVE-2018-8736 Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)
Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Nagios XI Chained Remote Code Execution',
'Description' => %q{
This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to gain remote root access.
The steps are:
1. Issue a POST request to /nagiosql/admin/settings.php which sets the database user to root.
2. SQLi on /nagiosql/admin/helpedit.php allows us to enumerate API keys.
3. The API keys are then used to add an administrative user.
4. An authenticated session is established with the newly added user
5. Command Injection on /nagiosxi/backend/index.php allows us to execute the paylo
Exploit-DB
Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root
exploitdb·2018-04-30·CVSS 9.8
CVE-2018-8736 [CRITICAL] Nagios XI 5.2.6 < 5.2.9 / 5.3 / 5.4 - Chained Remote Root
Nagios XI 5.2.6 ".format(cmdname)
end_idx = resp.find(end_delim)
resp = resp[:end_idx]
resp = resp[resp.rfind(begin_delim)+1:]
return resp
def parse_nagiosxi(resp):
resp = str(resp)
begin_delim = 'Set-Cookie: nagiosxi='
end_delim = ';'
# find the last instance of the nagiosxi cookie...
start_index = resp.rfind(begin_delim) + len(begin_delim)
resp = resp[start_index:]
end_index = resp.find(end_delim)
return resp[:end_index]
def parse_version(resp):
resp = str(resp)
begin_delim = 'name="version" value="'
end_delim = '"'
start_index = resp.rfind(begin_delim) + len(begin_delim)
resp = resp[start_index:]
end_index = resp.find(end_delim)
return resp[:end_index]
def change_db_user(usr, pwd, step):
url = '/nagiosql/admin/settings.php'
headers = {'Host' : RHOST,
'Content-Type' : 'applicat
Metasploit
Nagios XI Chained Remote Code Execution
metasploit
Nagios XI Chained Remote Code Execution
Nagios XI Chained Remote Code Execution
This module exploits an SQL injection, auth bypass, file upload, command injection, and privilege escalation in Nagios XI <= 5.2.7 to pop a root shell.
Metasploit
Nagios XI Chained Remote Code Execution
metasploit
Nagios XI Chained Remote Code Execution
Nagios XI Chained Remote Code Execution
This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to gain remote root access. The steps are: 1. Issue a POST request to /nagiosql/admin/settings.php which sets the database user to root. 2. SQLi on /nagiosql/admin/helpedit.php allows us to enumerate API keys. 3. The API keys are then used to add an administrative user. 4. An authenticated session is established with the newly added user 5. Command Injection on /nagiosxi/backend/index.php allows us to execute the payload with nopasswd sudo, giving us a root shell. 6. Remove the added admin user and reset the database user.
No writeups or analysis indexed.
https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXThttps://blog.redactedsec.net/exploits/2018/04/26/nagios.htmlhttps://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0fhttps://www.exploit-db.com/exploits/44560/https://www.exploit-db.com/exploits/44969/https://www.nagios.com/downloads/nagios-xi/change-log/https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXThttps://blog.redactedsec.net/exploits/2018/04/26/nagios.htmlhttps://gist.github.com/caleBot/f0a93b5a98574393e0139104eacc2d0fhttps://www.exploit-db.com/exploits/44560/https://www.exploit-db.com/exploits/44969/https://www.nagios.com/downloads/nagios-xi/change-log/
2018-04-18
Published