Are Your Nagios XI Servers Turning Into Cryptocurrency Miners for Attackers?
Summary: On March 16, 2021, Unit 42 researchers observed an attacker exploiting CVE-2021-25296, a remote command injection vulnerability in Nagios XI version 5.7.5's Windows WMI Configuration Wizard, to deploy the XMRig coinminer on victims' devices, and the attack was still ongoing at the time of writing. The attacker fetches a bash script named run.sh from the server 118[.]107[.]43[.]174, which downloads XMRig and releases scripts to run the miner in the background; the flaw was fixed in later versions by validating user input with escapeshellarg().
What's compelling: The compromised script re-downloads the latest run.sh from the attacker's server, so an infected Nagios XI host can be re-tasked with new commands at any time, not just mined on - and the observed config.json lacked a valid wallet address, meaning the attacker can activate working miners whenever they choose.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-25296
- Related
- CVE-2021-25296: Nagios XI OS Command Injection Known Exploited Vulnerabilities · Jan 18, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026