CVE-2021-25297

What is Nagios XI's LDAP Configuration Wizard?

Nagios XI includes configuration wizards that allow administrators to set up monitoring for various system types. The LDAP configuration wizard allows Nagios XI to monitor LDAP directories (Active Directory, OpenLDAP) by querying them via LDAP check commands. The wizard accepts parameters — including the LDAP server hostname or IP address — that are used to construct monitoring check commands executed on the Nagios XI server. When these parameters are not properly sanitized, they create OS command injection vulnerabilities: an attacker can inject shell commands into the LDAP check parameters, causing arbitrary commands to execute on the Nagios XI server with the elevated privileges of the Nagios backend process.

Overview

CVE-2021-25297 is an OS command injection vulnerability in Nagios XI's LDAP configuration wizard. The ldap_check parameter accepted by the wizard is incorporated into an OS command executed on the Nagios XI server without sanitization — an authenticated attacker with low-privilege credentials (PR:L) can inject arbitrary shell commands via this parameter, achieving root-level code execution on the monitoring server. CVE-2021-25297 is part of a three-CVE cluster (25296, 25297, 25298) discovered by Rana Khalil of Cisco Talos and patched in Nagios XI 5.7.5. All three affect different configuration wizards and were added to CISA KEV simultaneously in January 2022.

Affected Versions

Technical Details

• Root cause: OS command injection (CWE-78) in Nagios XI's LDAP wizard backend — the ldap_check parameter (controlling what LDAP server and query to test) is passed to a shell command used to verify LDAP connectivity without sanitizing shell metacharacters; injected sequences (;cmd, &&cmd, `cmd`) execute alongside the intended LDAP check command
• Low-privilege exploitation: PR:L — any authenticated Nagios XI user can access the LDAP wizard endpoint and trigger the injection regardless of their role; Nagios XI's fine-grained access control does not prevent low-privilege users from reaching configuration wizard endpoints by default
• Root execution: Backend Nagios XI processes run with elevated OS privileges to execute monitoring checks and write configuration; injected commands inherit these privileges, achieving root-level code execution
• LDAP context adds credential exposure: LDAP wizard functionality likely involves stored LDAP/Active Directory credentials within Nagios; post-exploitation can retrieve these AD credentials for lateral movement
• Same impact as CVE-2021-25296/25298: All three Nagios XI command injection CVEs achieve equivalent root RCE outcomes through different injection points — patching one does not protect against the others; Nagios XI 5.7.5 patches all three simultaneously

Discovery

Discovered by Rana Khalil of Cisco Talos alongside CVE-2021-25296 and CVE-2021-25298. Patched in Nagios XI 5.7.5. The simultaneous discovery of three command injection flaws in different Nagios XI wizards reflects a systematic code review finding unsanitized parameter usage throughout the wizard framework.

Exploitation Context

See CVE-2021-25296 for the broader exploitation context of Nagios XI monitoring server vulnerabilities. CVE-2021-25297's LDAP wizard vector is particularly relevant in enterprise environments where Nagios XI is integrated with Active Directory for authentication or monitoring — LDAP credentials stored in Nagios may provide an attacker direct access to AD after exploiting this vulnerability. Network monitoring servers are among the highest-value pivot points in enterprise networks.

Remediation

1. Update Nagios XI to version 5.7.5 or later — patches CVE-2021-25296, CVE-2021-25297, and CVE-2021-25298 together
2. Restrict Nagios XI web interface to authorized administrators — prevent low-privilege users from accessing configuration wizard endpoints
3. Restrict network access to the Nagios XI management interface; internet-accessible Nagios XI deployments should be firewalled immediately
4. Rotate LDAP/Active Directory credentials stored in Nagios XI configurations after patching
5. Review the Nagios XI server for unauthorized changes: new admin accounts, modified cron jobs, unexpected SSH keys, unusual outbound connections
6. Apply patches for all three wizard CVEs simultaneously — each independently provides root RCE