CVE-2020-28904: 
NixOS vulnerability analysis and mitigation

CVE-2020-28904 is a privilege escalation vulnerability affecting Nagios Fusion 4.1.8 and earlier versions. The vulnerability allows an attacker to escalate privileges to the nagios user through the installation of malicious components containing PHP code. This vulnerability was discovered and reported to Nagios in October 2020, and was subsequently patched in November 2020 (Skylight Cyber).

The vulnerability stems from execution with unnecessary privileges in Nagios Fusion, where malicious components containing PHP code can be installed to gain elevated privileges. This vulnerability is part of a larger chain of vulnerabilities that could be exploited together to compromise a complete Nagios deployment. The vulnerability allows an attacker to escalate from apache user privileges to nagios user privileges (Hacker News, GBHackers).

When exploited, this vulnerability allows attackers to gain elevated privileges as the nagios user, which could lead to further system compromise. In a broader context, when chained with other vulnerabilities, it could enable attackers to compromise an entire Nagios deployment infrastructure, potentially affecting multiple customer sites being monitored through Nagios Fusion (Skylight Cyber).

The vulnerability requires initial access as the apache user to exploit. It can be chained with other vulnerabilities (such as CVE-2020-28905 and CVE-2020-28903) to achieve a more significant impact. A post-exploitation tool called SoyGun was developed that chains this vulnerability with others to automate the exploitation process (Skylight Cyber).

The vulnerability was patched in versions released after Nagios Fusion 4.1.8. Organizations should upgrade to the latest version of Nagios Fusion to mitigate this vulnerability. The fix was implemented in November 2020 as part of a larger security update addressing multiple vulnerabilities (Hacker News).

The discovery of this vulnerability, along with 12 other vulnerabilities in Nagios products, raised concerns in the cybersecurity community about the security of IT infrastructure monitoring tools. The timing of these vulnerabilities' disclosure, following the SolarWinds attack, highlighted the growing importance of securing third-party technology hubs (Skylight Cyber).