Unrated

Improper Authorization in Nagios XI User Macros Component

IdentifiersCVE-2023-47412CWE-862

CVE-2023-47412 is an authorization flaw in the Nagios XI usermacros component affecting Nagios XI v5.11.1. According to the provided advisory context, any authenticated user could send crafted HTTP requests directly to the usermacros endpoint to access functionality intended to manage user and system macros. The issue allowed low-privileged authenticated users to view or modify user macros and system macros without proper privilege enforcement. The advisory further states that an authenticated user could overwrite the /usr/local/nagios/etc/resource.cfg macros file through these requests. Where macro redaction was disabled, sensitive macro values could also be disclosed directly.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows any authenticated Nagios XI user, including low-privileged users, to bypass intended access controls around macro management. This can result in unauthorized disclosure of sensitive macro values when redaction is disabled, and unauthorized modification or overwriting of user and system macros, including the /usr/local/nagios/etc/resource.cfg file. Because macros commonly store credentials, command arguments, and integration secrets, the vulnerability can enable credential exposure, operational tampering, monitoring disruption, and follow-on compromise of monitored systems or connected services.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict Nagios XI access to only trusted users, minimize the number of authenticated accounts, and closely audit all access to macro-management functionality and changes to /usr/local/nagios/etc/resource.cfg. Disable or tightly control low-privilege accounts that do not require macro access, review stored macro contents for secrets, rotate any credentials stored in macros that may have been exposed, and monitor for unauthorized HTTP requests to the usermacros component. These are compensating controls only; the authoritative fix is upgrading to 5.11.4 or later.

Remediation

Patch, then assume compromise.

Upgrade Nagios XI to version 5.11.4 or later. The provided advisory states that all 16 disclosed vulnerabilities, including CVE-2023-47412, were mitigated in Nagios XI 5.11.4.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ncc group researchNews

Dec 13, 2023

Technical Advisory – Multiple Vulnerabilities in Nagios XI

An authorization flaw in Nagios XI that allows any authenticated user to read or modify user and system macros, potentially exposing secrets or causing denial of service.

ncc group researchNews

Dec 13, 2023

Nagios XI Vulnerabilities Found | NCC Group

A medium-severity authorization flaw in Nagios XI that allows any authenticated user to read or modify user and system macros, potentially exposing secrets or causing denial of service.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity