Nagios XI Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Nagios XI version 2024R1.1.4. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the 'Name' parameter on the Account Settings page. The injected scripts are automatically executed when the affected page is accessed, potentially compromising other users' accounts.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed automatically for users who access the affected page.

Reproduction

To reproduce this vulnerability, navigate to the 'Account Settings' page in Nagios XI 2024R1.1.4. Inject a script payload into the 'Name' (alias) field, such as a script tag containing JavaScript code, such as an alert. Save the changes, and then visit the 'Host Status Detail', 'Host Group Summary', or 'Host Group Overview' pages to observe the execution of the injected script.

Remediation

Users are advised to upgrade to Nagios XI version 2024R1.1.5 or above.