CVE-2021-25298: 
Nagios XI vulnerability analysis and mitigation

Nagios XI version 5.7.5 is affected by an OS command injection vulnerability (CVE-2021-25298). The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input, which can lead to OS command injection on the Nagios XI server. The vulnerability was discovered in early 2021 and affects versions from 5.5.6 to 5.7.5 (Fastly Blog).

The vulnerability occurs when the ip_address parameter, controlled by the user through URL input, is passed to the exec function without proper sanitization in the cloud-vm configuration wizard. The vulnerable code processes the ip_address variable and passes it directly into a ping command execution. An attacker can use command operators like semicolon (;) to terminate the original command and inject arbitrary commands for execution. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary commands on the affected Nagios XI server. The commands would be executed with the privileges of the apache user, potentially leading to unauthorized access, data manipulation, or system compromise (Fastly Blog).

The vulnerability requires authentication (admin or non-admin) to exploit. A proof-of-concept exploit has been publicly disclosed, and the vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. A Metasploit module named 'nagios_xi_configwizards_authenticated_rce' has been developed to exploit this vulnerability (Fastly Blog, CISA).

Organizations are strongly advised to upgrade to the latest version of Nagios XI. Additionally, it is recommended to prevent Nagios XI from being exposed directly to the internet. The vulnerability can be tested using either the Metasploit module or Nuclei template. Fastly's NGWAF detects exploitation attempts of this CVE by default (Fastly Blog).