CVE-2024-13998

Executive Summary

CVE-2024-13998 is an information disclosure vulnerability in Nagios XI, a widely used IT infrastructure monitoring platform. Under certain circumstances, authenticated users can access sensitive user account information, including API keys and hashed passwords, that they should not have access to. This exposure could lead to account compromise, abuse of API privileges, or offline password cracking attempts. The vulnerability affects Nagios XI versions prior to 2024R1.1.3. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a core product vulnerability in Nagios XI.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual and likely indicates that a full CVSS vector has not been officially assigned. However, based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must be an authenticated user.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond its security scope.
• Confidentiality (C): High (H) – Sensitive data (API keys, password hashes) is disclosed.
• Integrity (I): None (N) – No data integrity impact.
• Availability (A): None (N) – No availability impact.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.5 (Medium)

Threat Level: Medium. While the confidentiality impact is high, the requirement for authentication reduces the overall severity.

Deep Dive & Mechanics

The vulnerability resides in the way Nagios XI handles user account data. Under certain conditions, the application fails to properly enforce access controls, allowing an authenticated user to view sensitive information belonging to other users. This information includes:

• API Keys: These keys are used for programmatic access to the Nagios XI API. Exposure could allow an attacker to perform actions on behalf of the compromised user, potentially with elevated privileges.
• Hashed Passwords: While hashed, these can be subjected to offline brute-force or dictionary attacks. If the hashing algorithm is weak (e.g., MD5, SHA1 without salting), the risk of cracking is significantly higher.

The exact mechanism is not publicly detailed, but it likely involves a flaw in the API endpoint or web interface that returns user profile data without proper authorization checks. For example, a user with limited privileges might be able to access an endpoint like /api/v1/users/{id} and retrieve data for any user ID, not just their own.

Vulnerable vs. Patched Code

Since the exact code is proprietary, we can only infer the fix. The patch likely involves adding proper authorization checks to the affected endpoints.

Vulnerable Code (Conceptual):

// In a controller or API handler
function getUserData($userId) {
    // No check to ensure the requesting user is the same as $userId
    $user = $db->query("SELECT * FROM users WHERE id = $userId");
    return json_encode($user);
}

Patched Code (Conceptual):

function getUserData($userId) {
    // Check if the requesting user is authorized
    $currentUser = getCurrentUser();
    if ($currentUser->id != $userId && !$currentUser->isAdmin()) {
        return json_encode(['error' => 'Unauthorized']);
    }
    $user = $db->query("SELECT * FROM users WHERE id = $userId");
    return json_encode($user);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on a vulnerable Nagios XI instance (version < 2024R1.1.3).
• Network access to the Nagios XI web interface.

Exploitation Steps:

1. Authenticate: Log in to the Nagios XI web interface with your user credentials.
2. Identify Endpoint: Use browser developer tools or a proxy (e.g., Burp Suite) to identify API endpoints that return user data. Look for patterns like /api/v1/users/, /admin/users/, or similar.
3. Enumerate Users: Try to access user data for other users by changing the user ID in the request. For example:
   • GET /api/v1/users/1
   • GET /api/v1/users/2
   • GET /api/v1/users/3
4. Extract Data: If the endpoint is vulnerable, it will return the API keys and password hashes for those users.
5. Exploit: Use the extracted API keys to access the Nagios XI API with the compromised user's privileges. Attempt to crack the password hashes offline.

Example Request (using curl):

curl -X GET "https://target.nagios.local/api/v1/users/2" \
  -H "Authorization: Bearer YOUR_API_KEY"

Blue Team

Detection:

• Monitor for unusual API requests, especially to user-related endpoints (e.g., /api/v1/users/).
• Look for requests from a single user account that enumerate multiple user IDs.
• Alert on any access to sensitive user data endpoints by non-admin users.

Hunting:

• Search web server logs for patterns like GET /api/v1/users/ followed by a numeric ID.
• Correlate these requests with the authenticated user's session ID.
• Check for any successful responses that contain api_key or password_hash fields.

Response:

• If a compromised account is detected, immediately revoke its API keys and force a password reset.
• Review the affected user's activity for any unauthorized actions.
• Apply the patch (upgrade to Nagios XI 2024R1.1.3) as soon as possible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual API requests to /api/v1/users/ or similar endpoints.
  • Requests from a single IP address enumerating multiple user IDs.
• System IOCs:
  • Web server logs showing GET /api/v1/users/ requests from non-admin users.
  • Database queries that retrieve user data without proper authorization.
• File IOCs:
  • No specific file-based IOCs are known.

Detection Engineering

YARA Rule

rule Detect_NagiosXI_InfoDisclosure_Attempt {
    meta:
        description = "Detects attempts to exploit CVE-2024-13998 by looking for API requests to user endpoints"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-13998"
    strings:
        $api_endpoint = "/api/v1/users/" ascii wide nocase
        $user_id_pattern = /\/api\/v1\/users\/\d+/ ascii wide nocase
    condition:
        $api_endpoint or $user_id_pattern
}

Sigma Rule

title: Nagios XI Information Disclosure Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-13998 by monitoring for API requests to user endpoints
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13998
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem|contains: "/api/v1/users/"
    condition: selection
falsepositives:
    - Legitimate admin activity
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Nagios XI Information Disclosure Attempt (CVE-2024-13998)";
    flow:to_server,established;
    content:"/api/v1/users/"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Upgrade Nagios XI to version 2024R1.1.3 or later. This is the official fix.
2. Review User Accounts: Audit all user accounts for any signs of compromise. Force password resets for all users.
3. Revoke API Keys: Regenerate all API keys to ensure any exposed keys are invalidated.

Long-Term Mitigations:

1. Principle of Least Privilege: Ensure users only have the minimum necessary permissions.
2. Network Segmentation: Place Nagios XI in a segmented network with strict access controls.
3. Web Application Firewall (WAF): Deploy a WAF to block malicious requests to sensitive endpoints.
4. Regular Security Audits: Conduct regular security assessments and code reviews.
5. Monitor Logs: Implement centralized logging and monitoring for suspicious activity.

Workarounds (if patching is not immediately possible):

• Restrict access to the Nagios XI web interface to trusted IP addresses only.
• Disable API access for non-admin users if possible.
• Implement additional authentication checks at the web server level (e.g., using .htaccess).

Valters IT
DevSecOps & Cyber Threat Intelligence