Nagios Flaw Enables Remote Attackers to Run Arbitrary JavaScript via XSS

Nagios has addressed a significant cross-site scripting (XSS) vulnerability in its enterprise monitoring platform Nagios XI that could allow remote attackers to execute arbitrary JavaScript code in users’ browsers, discovered in the Graph Explorer feature and patched in the 2024R2.1 release on 12 August 2024. The vulnerability was responsibly disclosed by security researcher Marius Lihet, according to Nagios, who identified the XSS weakness in certain parameters within the Graph Explorer functionality.

This component lets administrators visualise performance data and network metrics through interactive charts and graphs, making it a frequently accessed feature in enterprise environments. Cross-site scripting of this nature enables attackers to inject malicious JavaScript that could run within legitimate user sessions, potentially stealing authentication cookies, hijacking sessions, or performing actions on behalf of authenticated administrators.

Administrative users with elevated privileges were identified as particularly high-value targets for exploitation, and the update also delivers broader security and functionality improvements beyond the XSS remediation.