Loading vulnerability…
Command Injection RCE in Lilac-Reloaded for Nagios Autodiscovery
CVE-2023-53948 is a remote code execution vulnerability in Lilac-Reloaded for Nagios 2.0.8. The autodiscovery feature does not adequately filter input supplied through the nmap_binary parameter, allowing an attacker to inject arbitrary operating-system commands through a crafted POST request to the autodiscovery endpoint. Successful exploitation can be used to execute a reverse shell on the affected system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can execute arbitrary operating-system commands remotely, including establishing a reverse shell. This can result in remote compromise and potential full control of the affected system.
If you can’t patch tonight, do this now.
Restrict access to the autodiscovery endpoint to trusted administrative users and networks. Where updating is not immediately possible, apply compensating input validation for the nmap_binary parameter and prevent untrusted users from submitting requests to the affected endpoint.
Patch, then assume compromise.
Update Lilac-Reloaded for Nagios to a version that addresses the vulnerability when available. Ensure that input supplied to the nmap_binary parameter is strictly sanitized and validated so that shell metacharacters and command delimiters cannot reach command execution logic.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.