CVE-2020-13977

Vulnerability

Nagios 4.4.5 is affected by a vulnerability in the 'URL for JSON CGIs' configuration setting, as described in the CVE and referenced advisories [1][2][3][4]. An attacker with administrative privileges can modify this setting to point to crafted versions of archivejson.cgi, objectjson.cgi, and statusjson.cgi files, thereby altering the Alert Histogram and Trends code.

Exploitation

The attacker must already have administrative access to the Nagios system to change the 'URL for JSON CGIs' configuration setting. Once this setting is modified, the attacker can supply malicious CGI files that are executed when the Alert Histogram and Trends features are accessed. No additional user interaction or network position is required beyond administrative privileges.

Impact

Successful exploitation allows the attacker to modify the Alert Histogram and Trends code, potentially leading to arbitrary code execution with the privileges of the Nagios process. This could result in full compromise of the Nagios server and the data it monitors.

Mitigation

No official fix version has been disclosed in the available references. Users should monitor the Nagios Core changelog [4] for updates. As a workaround, restrict administrative access to trusted users only and review the 'URL for JSON CGIs' setting for unauthorized changes.