Debian DSA-6556-1: Nagios4 CSRF, XSS, and Command Execution Flaws — Detection and Remediation Guide

---
title: Nagios CGI Command Injection Attempt via cmd.cgi
id: 3b7a2c51-8e4d-4f1a-9c62-5d1e6a7b8c90
status: experimental
description: Detects suspicious requests to the Nagios cmd.cgi endpoint containing shell metacharacters or encoded payload indicators consistent with command injection through the monitoring console.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6556-1-nagios4
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/nagios/cgi-bin/cmd.cgi'
      - '/cgi-bin/nagios4/cmd.cgi'
  selection_payload:
    cs-uri-query|contains:
      - '%3B'         # encoded semicolon
      - '%7C'         # encoded pipe
      - '%60'         # backtick
      - '%24%28'      # $(
      - ';'
      - '|'
      - '$(`'
      - '/bin/sh'
      - '/bin/bash'
      - 'wget '
      - 'curl '
  condition: selection_uri and selection_payload
falsepositives:
  - Unusual but legitimate admin input containing special characters in comment fields
level: high
---
title: Web Server Spawning Shell Under Nagios Host
id: 9c1d4e82-3f6b-4a58-b7d2-8e0f1a2b3c4d
status: experimental
description: Detects Apache/httpd worker processes spawning shell interpreters or common post-exploitation binaries, consistent with successful command execution through a Nagios web interface vulnerability.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6556-1-nagios4
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/apache'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/wget'
      - '/curl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Nagios plugins legitimately invoked via check commands proxied by the web tier
  - Custom CGI scripts in the same vhost
level: high
---
title: Nagios Defense Suppression via Forged Console Commands
id: 5e8f3a19-7c2d-4b64-a391-6f4c8d5e2a10
status: experimental
description: Detects bulk or rapid-fire submissions to the Nagios command CGI that disable notifications, schedule downtime, or acknowledge problems — consistent with CSRF-driven defense suppression during an intrusion.
references:
  - https://linuxsecurity.com/advisories/debian/debian-dsa-6556-1-nagios4
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1562
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/nagios/cgi-bin/cmd.cgi'
      - '/cgi-bin/nagios4/cmd.cgi'
    cs-uri-query|contains:
      - 'cmd_typ=24'    # disable host notifications
      - 'cmd_typ=25'    # disable service notifications
      - 'cmd_typ=55'    # schedule host downtime
      - 'cmd_typ=56'    # schedule service downtime
      - 'cmd_typ=33'    # acknowledge host problem
      - 'cmd_typ=34'    # acknowledge service problem
      - 'cmd_typ=9'     # stop nagios process
      - 'cmd_typ=11'    # disable active checks globally
  condition: selection
falsepositives:
  - Legitimate maintenance windows and bulk acknowledgment by NOC staff
level: medium

// Hunt for command-injection and defense-suppression attempts against Nagios4 CGIs
// Ingests Apache/httpd access logs via CEF (CommonSecurityLog) or Syslog in Sentinel
union isfuzzy=true
    (CommonSecurityLog
     | where RequestURL has_any ("cmd.cgi")
     | extend Target = RequestURL, Query = coalesce(RequestURL, "")),
    (Syslog
     | where SyslogMessage has_any ("cmd.cgi")
     | extend Target = SyslogMessage, Query = SyslogMessage)
| where Query has_any (
    "%3B", "%7C", "%60", "%24%28", ";", "|", "$(",
    "/bin/sh", "/bin/bash", "wget ", "curl ",
    "cmd_typ=9", "cmd_typ=11", "cmd_typ=24", "cmd_typ=25",
    "cmd_typ=33", "cmd_typ=34", "cmd_typ=55", "cmd_typ=56")
| summarize AttemptCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            SampleRequests = make_list(strcat(tostring(Target)), 5)
        by SourceIP, Computer, bin(TimeGenerated, 1h)
| order by AttemptCount desc

-- Nagios4 compromise triage: shells spawned by web tier and recent CGI-accessible artifacts
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
    Name =~ '^(sh|bash|dash|python3?|perl|nc|ncat|wget|curl)$'
    AND CommandLine =~ '(?i)apache|httpd|nagios'
) OR (
    CommandLine =~ '(?i)(cmd\.cgi|nagios.*cgi-bin)'
)

#!/bin/bash
# DSA-6556-1 Nagios4 remediation and verification — Debian 13 (trixie)
set -euo pipefail

# 1. Identify current nagios4 package version
echo "[*] Current nagios4 version:"
dpkg -l nagios4 2>/dev/null | awk '/^ii/{print $3}'

# 2. Apply the security update
echo "[*] Updating package lists and applying DSA-6556-1 fix..."
apt-get update
apt-get install -y --only-upgrade nagios4 nagios4-common nagios4-cgi nagios4-core 2>/dev/null || \
  apt-get install -y --only-upgrade nagios4

# 3. Verify the patched version (fixed: 4.4.6-4.1+deb13u2 or later)
FIXED="4.4.6-4.1+deb13u2"
INSTALLED=$(dpkg-query -W -f='${Version}' nagios4 2>/dev/null || echo "none")
echo "[*] Installed: ${INSTALLED} | Required minimum: ${FIXED}"
if [ "$(dpkg --compare-versions "$INSTALLED" lt "$FIXED" && echo vulnerable)" = "vulnerable" ]; then
  echo "[!] STILL VULNERABLE — check apt sources include trixie-security"
  exit 1
else
  echo "[+] Patch verified."
fi

# 4. Restart services to load patched binaries
systemctl restart nagios4 apache2 2>/dev/null || systemctl restart nagios apache2

# 5. Hunt for signs of prior exploitation
echo "[*] Checking Apache logs for cmd.cgi abuse..."
grep -Ei 'cmd\.cgi.*(%3B|%7C|%60|%24%28|/bin/(ba)?sh|wget |curl )' \
  /var/log/apache2/access.log* 2>/dev/null | tail -20 || echo "[+] No injection patterns found."

echo "[*] Checking for shells spawned by the web server user..."
ps -eo user,pid,ppid,cmd | awk '$1=="www-data" && $NF ~ /sh$|bash|python|perl|nc$|curl|wget/'

echo "[*] Checking for unexpected files in nagios CGI and command dirs..."
find /usr/lib/cgi-bin/nagios4 /var/lib/nagios4 -newermt "-30 days" -type f 2>/dev/null

echo "[+] Triage complete. Review output above before declaring clean."