Nagios Fusion Session Hijacking Vulnerability Due to Inadequate Two-Factor Authentication Management

A session hijacking vulnerability exists in Nagios Fusion versions 2024R1.2 and 2024R2. When two-factor authentication (2FA) is enabled, the application does not invalidate existing session tokens. This oversight allows attackers to exploit active sessions and bypass the 2FA requirement, potentially leading to unauthorized actions.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can use an active session to perform actions without the 2FA verification, effectively bypassing the added security measure.

Remediation

Users are advised to update to Nagios Fusion version 2024R2.1, where this vulnerability has been addressed.