Advisories for Pypi/Linuxfabrik-Lib package

Every Linuxfabrik check plugin that supports the shared –test argument (routed through lib.lftest.test()) will, when –test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked through the shipped nagios/icinga sudoers allowlist. –test is a live production argument (centrally mapped to argparse.SUPPRESS, so it is hidden from –help but still …

lib.url.fetch() follows HTTP redirects (follow_redirects=True). httpx strips only Authorization and Cookie when a redirect crosses the origin, so any other caller-supplied credential header (a session token such as Redfish's X-Auth-Token, an API key, …) was still sent to the redirect target. A malicious or redirect-capable server can therefore answer an authenticated request with a 3xx to an attacker-chosen host and receive the credential (server-side request forgery + token disclosure). The …

When a check plugin places user provided input inside a command which is passed to shell_exec, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get root privileges.

The SQLite databases are created at predictable (static) paths in /tmp. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target. This becomes really dangerous for the scripts which can be executed as root with sudo. With this, an attacker can write to abitrary paths.

In the Debian.sudoers file, apt-get is allowed for the nagios user. The full command including the arguments are not enforced and can therefore be choosen arbitrarily. This allows to easily get a root shell as the nagios user: