CVE-2019-15949

Nagios XI before 5.6.6 is vulnerable to command injection (CWE-78) that yields remote code execution as root: the getprofile.sh script runs as root via a passwordless sudo entry when a user downloads a system profile (profile.php?cmd=download), and that script executes the check_plugin binary, which is owned by the nagios user. An attacker who is logged into the web interface with permission to modify plugins, or who has access to the server as the nagios user, can modify check_plugin to insert arbitrary commands that then run with root privileges. Because the flaw requires either an authenticated web session with plugin-modification rights or existing access as the nagios user, it is most dangerous as an escalation path after an account or host has already been compromised. All Nagios XI deployments running versions prior to 5.6.6 are affected. The flaw is in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), carries a high exploitation probability (EPSS ~77%), and public proof-of-concept exploits are available.

What to do: Upgrade Nagios XI to version 5.6.6 or later per vendor instructions, as required by CISA. As interim mitigation, restrict which accounts can modify plugins and limit access to the system profile download (profile.php?cmd=download), and inspect the check_plugin executable and the getprofile.sh sudoers entry for tampering. Review logs for system-profile downloads and unexpected root-level process activity to identify possible exploitation.