{"vulnerability": "CVE-2020-2864", "sightings": [{"uuid": "50e74a61-5a39-461c-8fb5-34784eb4ad58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28648", "type": "published-proof-of-concept", "source": "https://t.me/ptswarm/42", "content": "\"13 Nagios Vulnerabilities, #7 will SHOCK you!\" by Samir Ghanem\n\nGaining access to Nagios XI server results in upstream compromise of management server,  i.e. every other customer monitored. Exploitation facilitated with soygun tool.\n\nContents:\n \u2022 TL;DR\n \u2022 Why Nagios?\n \u2022 What is Nagios?\n \u2022 The Code\n \u2022 Challenge Accepted\n \u2022 What are we trying to achieve?\n \u2022 Step 1: RCE on Nagios XI server from low privilege Nagios XI user (CVE-2020-28648)\n \u2022 Step 2: Elevate privileges to \u2018root\u2019 on Nagios XI server (CVE-2020-28910)\n \u2022 Step 3: Trigger XSS by tainting data returned to Nagios Fusion from XI (CVE-2020-28903)\n \u2022 Step 4: Authenticated remote code execution on Nagios Fusion (CVE-2020-28905)\n \u2022 Step 5: Elevate privileges from apache to root using the \u2018cmd_subsys.php\u2019 (CVE-2020-28902)\n \u2022 Step 6: Get list of \u201cfused\u201d XI servers and exploit them using Step 1 and 2\n \u2022 PoC or Attack Platform\n \u2022 SoyGun\n \u2022 Command & Control (C2)\n \u2022 SoyGun Implant\n \u2022 DeadDrop\n \u2022 Demo\n \u2022 Disclosure and Afterthoughts\n \u2022 Full Vulnerabilities List\n\nhttps://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/", "creation_timestamp": "2021-05-27T17:17:10.000000Z"}, {"uuid": "e7428026-95a7-4910-a6ab-b28f15ded7d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28646", "type": "seen", "source": "https://t.me/cibsecurity/24218", "content": "\u203c CVE-2020-28646 \u203c\n\nownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain directories when they were present.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-26T18:38:56.000000Z"}, {"uuid": "37463bbd-d8ad-462f-a7dc-b577635c712c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28641", "type": "seen", "source": "https://t.me/cibsecurity/21209", "content": "\u203c CVE-2020-28641 \u203c\n\nIn Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-23T02:53:46.000000Z"}, {"uuid": "2157c2c1-82e1-4350-a3ce-7047450a8e46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-28647", "type": "seen", "source": "https://t.me/cibsecurity/16438", "content": "\u203c CVE-2020-28647 \u203c\n\nIn Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser (XSS).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-17T16:39:04.000000Z"}]}