Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2021-43584
CVE-2021-43584:
Nagios Cross-Platform Agent (NCPA) vulnerability analysis and mitigation
Overview
DOM-based Cross Site Scripting (XSS) vulnerability was discovered in the 'Tail Event Logs' functionality of Nagios Cross-Platform Agent (NCPA) versions before 2.4.0. The vulnerability allows attackers to execute arbitrary code via the name element when filtering for a log (NIST NVD, MITRE CVE).
Technical details
The vulnerability exists in the 'Tail Event Logs' functionality accessed via the 'Live Data' dashboard. The issue occurs because the application sets the value of the search term on the name element using the jQuery .html() function instead of .text(), allowing for JavaScript code execution. The vulnerable code is located in the agent/listener/templates/tail.html file, where the name parameter is unsafely set using $('.name').html(name) (GitHub Issue). The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NIST NVD).
Impact
An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of an administrative NCPA user by tricking the user to enter a cross-site scripting (XSS) payload in the 'Tail Event Logs' page. This could lead to the exfiltration of the NCPA community string and gain of administrative access to the NCPA web interface (GitHub Issue).
Mitigation and workarounds
The vulnerability has been fixed in NCPA version 2.4.0. The recommended mitigation is to upgrade to version 2.4.0 or later. For those unable to upgrade immediately, the technical recommendation is to modify the code to use jQuery .text() function instead of .html() when setting values on the name element (GitHub Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management