Vulnerabilities

An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server because nmap can be run as root. The attacker achieves total control over the server.

EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/main.php.

An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.

EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail").

An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS.

EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios_path parameter to lilac/export.php, as demonstrated by %26%26+curl to insert an "&& curl" substring for the shell.

EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in CVE-2021-27513 exploitation).

An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to exploit the username_available function of the includes/functions.php file (which is called by login.php).

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the user_id field in a cookie.

EyesOfNetwork 5.3 ships a sudoers configuration that grants the apache user the ability to run nmap 7 as root without a password, an improper privilege management flaw (CWE-269). A local attacker who has already obtained code execution in the apache user's context, typically through the monitoring platform's web application, can supply a crafted NSE (Lua) script that nmap executes with root privileges. Successful exploitation yields arbitrary command execution as root, giving the attacker full control of the monitoring server with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8). Organizations running EyesOfNetwork 5.3 are affected. The flaw has public proof-of-concept exploits, a 60.1% EPSS score (99th percentile), and was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild.

Do: Apply EyesOfNetwork updates per the vendor's instructions, prioritizing internet-facing monitoring servers since the issue is on CISA KEV with a high EPSS score. As an interim mitigation, audit /etc/sudoers for the apache user's passwordless nmap entry and restrict it so nmap cannot run attacker-controlled NSE scripts (e.g., limit scripts to a trusted, non-writable directory) or remove the sudo grant. Review apache and nmap process logs for signs of prior root-level compromise.

EyesOfNetwork 5.3 ships with a single hard-coded API key (EONAPI_KEY in include/api_functions.php, used by API version 2.4.2) that is identical across all installations. Because the secret is baked into the source, any unauthenticated remote attacker can use it to calculate or guess a valid admin access token for the product's API, with no privileges or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). An attacker with an admin token gains administrative control of the EyesOfNetwork API, and public proof-of-concept material for EyesOfNetwork 5.3 (a PacketStorm write-up demonstrating command execution via the AutoDiscovery component) shows how flaws in this release can be chained toward broader compromise. All EyesOfNetwork 5.3 deployments are affected, with exposure limited to installations whose API is reachable by untrusted users or the internet. The flaw is listed in CISA KEV (added 2021-11-03), confirming exploitation in the wild; EPSS estimates a 91.9% probability of exploitation within 30 days, though ransomware use is not confirmed.

Do: Upgrade EyesOfNetwork per the vendor's instructions, as required by the CISA KEV listing. If patching is delayed, replace the default EONAPI_KEY with a unique random key, regenerate admin API tokens, and restrict access to the HTTP/API service to trusted networks. Audit API logs for admin tokens minted with the default key and check for chained exploitation via the AutoDiscovery command-execution issue, given confirmed in-the-wild activity.

EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.

SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.

SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php.

SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and update_group).

A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to module/admin_device/index.php.

Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the url parameter to module/module_frame/index.php.

Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/module_filters/index.php.

The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php.

SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.

In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\snmpwalk.php does not properly restrict popen calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in a parameter.

The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.

EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root

Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) bp_name, (2) display, (3) search, or (4) equipment parameter to module/monitoring_ged/ged_functions.php or the (5) type parameter to monitoring_ged/ajax.php.