CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linuxfabrik Monitoring Plugins prior to version 5.1.0, specifically allowing the nagios or icinga accounts to execute the `apt-get` command as root without proper argument restrictions. This flaw enables an attacker with control over the monitoring account to execute arbitrary commands, potentially leading to a complete compromise of the host system. Organizations using these monitoring plugins on Debian systems should prioritize updating to version 5.1.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who already controls that monitoring account can supply the APT::Update::Pre-Invoke option to execute an arbitrary command while apt-get runs with root privileges, resulting in a root shell and complete compromise of the host. The vulnerable rule supports the check-plugins/deb-updates/deb-updates plugin, but it authorized arbitrary apt-get argument sequences rather than only the required apt-get update --quiet 2 command. This issue is fixed in version 5.1.0.