Nagios XI Privilege Escalation Vulnerability via Migrate Server Feature

A privilege escalation vulnerability has been identified in Nagios XI versions prior to 2024R1.1.3. This vulnerability allows an authenticated administrator to use the Migrate Server feature to gain root privileges on the host running Nagios XI. By exploiting this migration workflow, an admin-level attacker could perform actions beyond the application's intended security boundaries, leading to full control over the operating system.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, giving an administrator root access on the server hosting Nagios XI.

Reproduction

To reproduce this vulnerability, an authenticated administrator can access the Migrate Server feature within Nagios XI. By manipulating the migration process, it is possible to escalate privileges to root on the underlying host.

Remediation

Users can upgrade to Nagios XI version 2024R1.1.3 or later to address this vulnerability.