CVE-2021-40345 — AI Deep Analysis Summary

🚨 **Essence**: Command Injection via ZIP upload in Admin Panel. 💥 **Consequences**: Attackers can execute arbitrary system commands on the server. This leads to full server compromise and data theft.

🛡️ **Root Cause**: Improper validation of uploaded ZIP file names. 🔍 **Flaw**: The system processes the **first file's name** in the archive as a command. If it contains malicious code, it gets executed.…

🏢 **Affected**: Nagios XI. 📦 **Version**: Specifically **5.8.5**. 📂 **Component**: Admin Panel > Manage Dashlets section.

💀 **Attacker Actions**: Execute **System Commands**. 🔓 **Privileges**: Likely **Admin/Root** level access since it's an admin panel feature. 📊 **Data**: Full access to monitored infrastructure data and server files.

⚠️ **Threshold**: **Medium/High**. 🔑 **Auth Required**: Yes, **Authenticated** access is needed. 📝 **Config**: Requires access to the 'Manage Dashlets' page to upload the malicious ZIP.

🔥 **Public Exploit**: **YES**. 📜 **PoC**: Available on GitHub (ArianeBlow/NagiosXI-RCE-all-version-CVE-2021-40345). 🛠️ **Method**: Download legitimate dashlet -> Inject PHP reverse shell -> Re-zip -> Upload.

🔍 **Self-Check**: 1. Check if running **Nagios XI 5.8.5**. 2. Verify if **Admin Dashlets** upload feature is enabled. 3. Scan for uploaded ZIP files with suspicious names in the dashlets directory.

🩹 **Official Fix**: **YES**. 📅 **Date**: Patched/Announced around **Oct 26, 2021**. 📖 **Ref**: Check Nagios XI CHANGES-5.TXT for the specific patch version.

🚧 **No Patch Workaround**: 1. **Disable** the 'Manage Dashlets' upload feature if not needed. 2. **Restrict** access to the Admin Panel strictly. 3. **Monitor** logs for unusual command executions via dashlet names.

⚡ **Urgency**: **HIGH**. 🚨 **Priority**: Immediate patching required. 📉 **Risk**: RCE is critical. Even with auth, the ease of exploitation (ZIP upload) makes it dangerous for any exposed admin interface.