Nagios Log Server Privilege Escalation Vulnerability in Logstash Process

A vulnerability allowing execution with unnecessary privileges has been identified in Nagios Log Server versions prior to 2024R2.0.3. This issue arises because the embedded Logstash process runs as the root user. An attacker could exploit this vulnerability by compromising the Logstash process, potentially through an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing. Such an exploitation could lead to code execution with root privileges, resulting in a full system compromise. To mitigate this risk, the Logstash service has been updated to run as the lower-privileged 'nagios' user.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution with root privileges, allowing for a complete compromise of the system.

Remediation

Users are advised to upgrade to Nagios Log Server version 2024R2.0.3 or above.