Description
Lilac-Reloaded for Nagios 2.0.8 contains a remote code execution vulnerability in the autodiscovery feature that allows attackers to inject arbitrary commands. Attackers can exploit the lack of input filtering in the nmap_binary parameter to execute a reverse shell by sending a crafted POST request to the autodiscovery endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cat03 | Lilac-Reloaded | ≤ 2.0.8 | — |
References
- ExploitDB-51374 exploit
- Official Product Homepage product
- VulnCheck Advisory: Lilac-Reloaded for Nagios 2.0.8 Remote Code Execution via Autodiscovery third-party-advisory