{"vulnerability": "CVE-2021-37343", "sightings": [{"uuid": "79c7da4c-763d-4cf2-92be-08d5f1e17141", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37343", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "6ab6e207-afec-4c1d-a0c8-a7bc83ca5d12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37343", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "5e61c62c-7464-4073-8ac0-e140d9509924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37343", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "", "creation_timestamp": "2021-03-26T23:19:21.000000Z"}, {"uuid": "e0b044d6-e15a-4aa9-820c-071b37d461ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37343", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_autodiscovery_webshell.rb", "content": "", "creation_timestamp": "2022-02-11T18:04:03.000000Z"}, {"uuid": "0107c5a1-6f49-482c-b0f6-28122bee1a7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37343", "type": "seen", "source": "https://t.me/cibsecurity/27296", "content": "\u203c CVE-2021-37343 \u203c\n\nA path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-13T16:40:57.000000Z"}, {"uuid": "59f13409-ec5d-479d-a463-56c4d453511e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37343", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The module detects the version of Nagios XI applications and\\n        suggests matching exploit modules based on the version number.\\n        Since Nagios XI applications only reveal the version to authenticated\\n        users, valid credentials for a Nagios XI account are required.\\n        Alternatively, it is possible to provide a specific Nagios XI version\\n        number via the `VERSION` option. In that case, the module simply\\n        suggests matching exploit modules and does not probe the target(s).\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/nagios_xi_scanner\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Nagios XI Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/http/nagios_xi_scanner.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nagios_xi_scanner\", \"references\": [\"CVE-2019-15949\", \"CVE-2020-5791\", \"CVE-2020-5792\", \"CVE-2020-35578\", \"CVE-2021-37343\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:38.440958Z"}, {"uuid": "fbaa6250-5b1a-4b7d-9241-51972c1e5d91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37343", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_autodiscovery_webshell.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Claroty Team82\", \"jbaines-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a path traversal issue in Nagios XI before version 5.8.5 (CVE-2021-37343).\\n          The path traversal allows a remote and authenticated administrator to upload a PHP web shell\\n          and execute code as `www-data`. The module achieves this by creating an autodiscovery job\\n          with an `id` field containing a path traversal to a writable and remotely accessible directory,\\n          and `custom_ports` field containing the web shell. A cron file will be created using the chosen\\n          path and file name, and the web shell is embedded in the file.\\n\\n          After the web shell has been written to the victim, this module will then use the web shell to\\n          establish a Meterpreter session or a reverse shell. By default, the web shell is deleted by\\n          the module, and the autodiscovery job is removed as well.\", \"disclosure_date\": \"2021-07-15\", \"fullname\": \"exploit/linux/http/nagios_xi_autodiscovery_webshell\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"Nagios XI Autodiscovery Webshell Upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/nagios_xi_autodiscovery_webshell.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/nagios_xi_autodiscovery_webshell\", \"references\": [\"CVE-2021-37343\", \"URL-https://claroty.com/2021/09/21/blog-research-securing-network-management-systems-nagios-xi/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:45.404158Z"}]}