Lilac-Reloaded for Nagios Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Lilac-Reloaded for Nagios version 2.0.8. The issue arises in the autodiscovery feature, where the nmap_binary parameter lacks proper input validation. This flaw allows attackers to inject arbitrary commands, such as executing a reverse shell, by sending a crafted POST request to the autodiscovery endpoint.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Lilac-Reloaded is installed.

Reproduction

To reproduce this vulnerability, send a POST request to the autodiscovery endpoint with a payload that includes a command injection in the nmap_binary parameter. The injected command can be crafted to establish a reverse shell connection.