Nagios XI Host Header Injection Vulnerability

A host header injection vulnerability has been identified in Nagios XI versions prior to 2024R1.2.2. This vulnerability arises because the application does not properly validate user-supplied HTTP Host headers when creating absolute URLs. As a result, an unauthenticated, remote attacker can send a crafted Host header to manipulate generated links or responses. This could lead to phishing attacks for credentials, hijacking of account recovery links, and web cache poisoning.

Impact

Exploitation of this vulnerability could allow for host header injection, leading to web cache poisoning and potential phishing attacks.

Remediation

Users can update to Nagios XI version 2024R1.2.2 or later to address this vulnerability.