CVE-2020-5792: 
Nagios XI vulnerability analysis and mitigation

CVE-2020-5792 is a command injection vulnerability discovered in Nagios XI version 5.7.3. The vulnerability allows a remote authenticated administrator to write to arbitrary files and execute code with apache user privileges due to improper neutralization of argument delimiters in commands (Tenable Research, NVD).

The vulnerability exists in the send_custom_trap() function within /nagiosxi/html/includes/components/nxti/index.php. The command line is escaped using PHP's escapeshellcmd() function, which proves insufficient as attackers can still inject arbitrary arguments. The vulnerability has a CVSS v3 Base Score of 4.7 (Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) (Tenable Research).

Successful exploitation of this vulnerability allows an authenticated attacker with admin rights to execute arbitrary code with the privileges of the apache user. The attacker can write to arbitrary files and ultimately achieve remote code execution on the affected system (Tenable Research).

The vulnerability requires authentication with administrative privileges for exploitation. It can be exploited by injecting arguments into the snmptrap command, using flags like -d to display captured SNMP requests and -L to log output to arbitrary file locations. The vulnerability can also be chained with CSRF attacks, potentially allowing unauthenticated exploitation if an administrator clicks a malicious link (Tenable Research).

The recommended mitigation is to upgrade to Nagios XI version 5.7.4 or newer, which contains patches for this vulnerability (Tenable Research).