CVE-2023-28354
Published: 09 January 2025
Description
An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against affected targets, specifying known NRPE plugins, which in default installations are configured to accept command control characters and pass them to command-line interpreters for NRPE plugin execution. This allows the attacker to escape NRPE plugin execution and execute commands remotely on the target as NT_AUTHORITY\SYSTEM.
Security Summary
CVE-2023-28354 is a critical vulnerability (CVSS 3.1 score of 9.8) affecting Opsview Monitor Agent version 6.8, classified under CWE-94 (Improper Control of Generation of Code). The flaw resides in the check_nrpe functionality, where default installations of known NRPE plugins are configured to accept command control characters. These characters are passed to command-line interpreters during NRPE plugin execution, enabling attackers to break out of the intended execution context.
An unauthenticated remote attacker can exploit this vulnerability by calling check_nrpe against affected targets and specifying known NRPE plugins. Successful exploitation allows the attacker to execute arbitrary commands remotely on the target system with NT_AUTHORITY\SYSTEM privileges, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation details and additional information are provided in the advisory at https://github.com/stormfleet/CVE-2023-28354/blob/main/README.md.
Details
- CWE(s)