CVE-2020-8655

EyesOfNetwork 5.3 ships a sudoers configuration that grants the apache user the ability to run nmap 7 as root without a password, an improper privilege management flaw (CWE-269). A local attacker who has already obtained code execution in the apache user's context, typically through the monitoring platform's web application, can supply a crafted NSE (Lua) script that nmap executes with root privileges. Successful exploitation yields arbitrary command execution as root, giving the attacker full control of the monitoring server with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Organizations running EyesOfNetwork 5.3 are affected. The flaw has public proof-of-concept exploits, a 60.1% EPSS score (99th percentile), and was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild.

What to do: Apply EyesOfNetwork updates per the vendor's instructions, prioritizing internet-facing monitoring servers since the issue is on CISA KEV with a high EPSS score. As an interim mitigation, audit /etc/sudoers for the apache user's passwordless nmap entry and restrict it so nmap cannot run attacker-controlled NSE scripts (e.g., limit scripts to a trusted, non-writable directory) or remove the sudo grant. Review apache and nmap process logs for signs of prior root-level compromise.