CVE-2021-25296: 
Nagios XI vulnerability analysis and mitigation

CVE-2021-25296 is a remote code execution vulnerability affecting Nagios XI version 5.7.5 and earlier versions down to 5.5.6. The vulnerability exists in the Windows WMI Monitoring Wizard component, specifically in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. The flaw allows authenticated users (both admin and non-admin) to perform OS command injection on the Nagios XI server due to improper sanitization of user-controlled input (Fastly Blog, ConnectWise).

The vulnerability stems from improper validation of the 'plugin_output_len' parameter in the Windows WMI Monitoring Wizard. When this parameter is not empty, it's passed to a series of WMI commands without proper sanitization or validation to determine if the input is numerical. The vulnerability can be exploited through a single HTTP request by injecting OS commands into the plugin_output_len parameter. The CVSS v3.1 base score for this vulnerability is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability allows authenticated attackers to execute arbitrary operating system commands on the affected Nagios XI server. This can lead to complete system compromise, including unauthorized access to sensitive data, system modification, and potential lateral movement within the network (CISA).

The vulnerability has been actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities Catalog. Exploitation requires valid authentication credentials (either admin or non-admin), and proof-of-concept code has been publicly available since early 2021. A Metasploit module has been developed for this vulnerability, making it easily exploitable by both attackers and security professionals (Fastly Blog).

Organizations should upgrade to the latest version of Nagios XI beyond version 5.7.5. It is also recommended to prevent Nagios XI from being exposed directly to the internet. For detection purposes, organizations can use either the available Metasploit module or Nuclei template to test for the presence of the vulnerability. Fastly's NGWAF detects exploitation attempts of this CVE by default (Fastly Blog).