Nagios Log Server Cleartext API Key Exposure Vulnerability

A vulnerability in Nagios Log Server versions prior to 2024R1.3.2 allows authenticated users to access cleartext administrative API keys. This is achieved through a specific API call that retrieves user account information, including API keys, which can lead to unauthorized access and actions within the application.

Impact

Exploitation of this vulnerability allows for unauthorized retrieval of API keys, including those with administrative privileges. This could lead to user enumeration, privilege escalation, and potentially full system compromise by misusing the exposed tokens.

Reproduction

To reproduce this vulnerability, send a GET request to the '/nagioslogserver/index.php/api/system/get_users' endpoint, including a valid API token. The response will contain a list of user accounts with their corresponding API keys in cleartext.

Remediation

Users are advised to update Nagios Log Server to version 2024R1.3.2 or later.