CVE-2025-67254

Executive Summary

CVE-2025-67254 is a Directory Traversal vulnerability discovered in NagiosXI version 2026R1.0.1 build 1762361101. The flaw resides in the /admin/coreconfigsnapshots.php endpoint, allowing an authenticated attacker to read arbitrary files on the server's filesystem. This can lead to the disclosure of sensitive configuration files, credentials, and other critical data. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time, but the risk remains high due to the potential impact.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the nature of the vulnerability (Directory Traversal), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs valid credentials to access the admin interface.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Arbitrary file read can expose sensitive data.
• Integrity (I): None (N) – The vulnerability does not allow file modification.
• Availability (A): None (N) – The vulnerability does not affect availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.5 (Medium)

Threat Level: Medium to High. While the EPSS score is low, the potential for data exfiltration and the lack of a patch make this a significant concern for organizations using the affected NagiosXI version.

Deep Dive & Mechanics

The vulnerability is a classic Directory Traversal (Path Traversal) flaw in the coreconfigsnapshots.php script. This script is part of the NagiosXI admin interface and is used to manage configuration snapshots. The vulnerability likely stems from insufficient sanitization of user-supplied input, such as a file or snapshot parameter, which is then used to construct a file path for reading.

An attacker with valid admin credentials can manipulate this parameter to include path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files on the server. For example, a request like:

GET /admin/coreconfigsnapshots.php?file=../../../../etc/passwd

could return the contents of the /etc/passwd file.

The impact is significant because an attacker could read:

• NagiosXI configuration files (e.g., config.inc.php) containing database credentials.
• System files (e.g., /etc/shadow, /etc/ssl/private/...) for privilege escalation.
• Application source code to find further vulnerabilities.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a typical fix would involve:

• Vulnerable Code (Conceptual):

  $file = $_GET['file'];
  $content = file_get_contents('/var/nagios/snapshots/' . $file);
  echo $content;
  

• Patched Code (Conceptual):

  $file = basename($_GET['file']);
  $allowed_path = '/var/nagios/snapshots/';
  $full_path = realpath($allowed_path . $file);
  if (strpos($full_path, $allowed_path) !== 0) {
      die('Invalid file.');
  }
  $content = file_get_contents($full_path);
  echo $content;
  

The patched version uses basename() to strip directory components and realpath() to resolve the full path, then checks that the resolved path starts with the allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid admin credentials for NagiosXI.
• Network access to the NagiosXI web interface.

Exploitation Steps:

1. Authenticate: Log in to NagiosXI as an admin user.

2. Craft the Request: Use a tool like curl or Burp Suite to send a crafted GET request to the vulnerable endpoint.

   curl -u "admin:password" "http://target/nagiosxi/admin/coreconfigsnapshots.php?file=../../../../etc/passwd"
   

3. Extract Data: The response will contain the contents of the requested file. For example, the /etc/passwd file.

4. Escalate: Use the extracted information (e.g., database credentials from config.inc.php) to gain further access.

Example Request (Burp Suite):

GET /nagiosxi/admin/coreconfigsnapshots.php?file=../../../../etc/passwd HTTP/1.1
Host: target
Authorization: Basic YWRtaW46cGFzc3dvcmQ=

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /admin/coreconfigsnapshots.php with parameters containing ../ or other path traversal patterns.
• Alert on unusual file reads, especially of sensitive system files like /etc/passwd, /etc/shadow, or application configuration files.

Response:

• Immediately isolate the affected server.
• Review access logs to determine the scope of the breach.
• Rotate all credentials that may have been exposed.
• Apply the vendor's patch as soon as it becomes available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/coreconfigsnapshots.php with parameters containing ../ or ..%2f.
  • Unusual outbound data transfers from the NagiosXI server.
• File System IOCs:
  • Unexpected access to files outside the web root, such as /etc/passwd, /etc/shadow, or /var/nagiosxi/config.inc.php.
• Log IOCs:
  • Web server logs showing requests like:

    GET /nagiosxi/admin/coreconfigsnapshots.php?file=../../../../etc/passwd
    

  • Application logs showing errors related to file inclusion or path traversal.

Detection Engineering

YARA Rule

rule CVE_2025_67254_NagiosXI_Directory_Traversal {
    meta:
        description = "Detects attempts to exploit CVE-2025-67254 in NagiosXI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67254"
        severity = "high"
    strings:
        $s1 = "coreconfigsnapshots.php" nocase
        $s2 = "../" ascii wide
        $s3 = "..\\" ascii wide
        $s4 = "%2e%2e%2f" ascii wide
        $s5 = "%2e%2e/" ascii wide
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-67254 NagiosXI Directory Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit a directory traversal vulnerability in NagiosXI /admin/coreconfigsnapshots.php
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-67254
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/coreconfigsnapshots.php'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-67254 NagiosXI Directory Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin/coreconfigsnapshots.php"; http_uri;
    content:"../"; http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2025-67254;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, restrict access to /admin/coreconfigsnapshots.php using a web server configuration (e.g., .htaccess or Nginx location block) to only allow trusted IP addresses.
2. Implement a WAF rule: Block requests containing path traversal sequences (../, ..\\, URL-encoded variants) to the vulnerable endpoint.
3. Monitor logs: Actively monitor web server and application logs for signs of exploitation.

Long-Term Fix:

• Apply the vendor patch: As soon as Nagios releases a security update, apply it immediately.
• Upgrade NagiosXI: If a patched version is available, upgrade to the latest stable release.
• Code Review: Conduct a security code review of the coreconfigsnapshots.php script to ensure proper input validation and sanitization.

Workaround:

• If patching is not immediately possible, consider removing or renaming the coreconfigsnapshots.php file if it is not essential for operations.

Valters IT