CVE-2024-43199 Overview
CVE-2024-43199 is a local privilege escalation vulnerability in Nagios NDOUtils before version 2.1.4. The flaw stems from insecure file ownership: certain executable files are installed as owned by the nagios user. An attacker who has already gained code execution as the nagios user can modify these binaries and wait for them to be executed with elevated privileges, resulting in a full escalation to root. The vulnerability is tracked under CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-269 (Improper Privilege Management).
Critical Impact
A local attacker with nagios user access can escalate to root, gaining complete control over the monitoring host and any credentials or infrastructure it can reach.
Affected Products
- Nagios NDOUtils versions prior to 2.1.4
- Systems where NDOUtils binaries were installed with -o ndo2db_user -g ndo2db_group
- Nagios monitoring deployments using the vulnerable INSTALL_OPTS configuration
Discovery Timeline
- 2024-08-07 - CVE-2024-43199 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43199
Vulnerability Analysis
Nagios NDOUtils is a component that exports current and historical Nagios data to a database. The ndo2db daemon typically runs with elevated privileges to read Nagios status data and write to protected locations. During installation, prior versions passed INSTALL_OPTS="-o $ndo2db_user -g $ndo2db_group" to the install command, causing binaries to be owned by the nagios account rather than root.
Because the nagios user owns the executables, any process running as nagios can overwrite or replace them. When the binary is subsequently invoked by a privileged context, such as root via systemd, init, or a cron job, the attacker-controlled code executes with those privileges. This converts a limited compromise of the nagios service account into full host takeover.
Root Cause
The root cause is an insecure default in the build system. In configure.ac, the INSTALL_OPTS variable was set to install compiled binaries under the same UID/GID that runs the ndo2db daemon. Binaries meant to be executed by privileged processes must be owned by root with no write permission for lower-privileged accounts. Assigning ownership to nagios violates the least-privilege principle for executables that cross a trust boundary.
Attack Vector
Exploitation requires local access as the nagios user, which can be obtained through a separate web-facing Nagios flaw, a weak service configuration, or lateral movement. Once the attacker controls the nagios account, the workflow is:
- Identify writable ndo2db binaries owned by nagios.
- Replace or trojanize the binary with attacker-controlled code.
- Wait for the privileged invocation, or trigger a service restart, to execute the payload as root.
The following patch fragment shows the fix that removes the insecure install option.
AC_ARG_WITH(ndo2db_group,AC_HELP_STRING([--with-ndo2db-group=<group>],[sets group name to run NDO2DB]),ndo2db_group=$withval,ndo2db_group=nagios)
AC_SUBST(ndo2db_user)
AC_SUBST(ndo2db_group)
-INSTALL_OPTS="-o $ndo2db_user -g $ndo2db_group"
-AC_SUBST(INSTALL_OPTS)
Source: NagiosEnterprises/ndoutils commit 18ef120
Detection Methods for CVE-2024-43199
Indicators of Compromise
- Nagios NDOUtils executables (for example ndo2db, ndomod.o) owned by the nagios user or group rather than root.
- Modification timestamps on NDOUtils binaries that do not match the package installation date.
- Unexpected child processes spawned by ndo2db running as root.
- New SUID binaries or cron entries created shortly after a Nagios service restart.
Detection Strategies
- Audit filesystem ownership on Nagios hosts: find /usr/local/nagios -type f -perm -u+x -user nagios.
- Compare installed binary hashes against known-good values from the 2.1.4 release.
- Monitor process creation events where a parent owned by nagios writes to files later executed by root.
- Enable file integrity monitoring on /usr/local/nagios/bin/ and any custom NDOUtils install path.
Monitoring Recommendations
- Alert on any write operation to NDOUtils executables outside a package manager or approved deployment window.
- Track privilege transitions where ndo2db spawns shells, interpreters, or network utilities.
- Log and review systemctl restart and service calls involving ndo2db for correlation with binary modifications.
How to Mitigate CVE-2024-43199
Immediate Actions Required
- Upgrade Nagios NDOUtils to version 2.1.4 or later on all monitoring hosts.
- Change ownership of existing NDOUtils binaries to root:root and remove write access for the nagios user and group.
- Rotate credentials accessible to the Nagios host, including database passwords used by ndo2db.
- Review recent process and file activity on the nagios account for signs of prior exploitation.
Patch Information
The fix is delivered in NDOUtils 2.1.4. The upstream commit 18ef12037f4a68772d6840cbaa08aa2da07d2891 removes the INSTALL_OPTS assignment in configure.ac and Makefile.in so binaries install with default root ownership. Additional context is available in Pull Request #65, the ndoutils-2.1.3...ndoutils-2.1.4 diff, and the oss-security advisory.
Workarounds
- If patching is delayed, manually reset ownership: chown root:root on all NDOUtils executables and set permissions to 0755.
- Restrict shell access for the nagios account and disable interactive logins.
- Isolate the Nagios host on a management network segment to limit blast radius if the nagios account is compromised.
# Manual mitigation for existing installations
sudo chown root:root /usr/local/nagios/bin/ndo2db
sudo chmod 0755 /usr/local/nagios/bin/ndo2db
sudo find /usr/local/nagios -type f -perm -u+x -user nagios \
-exec chown root:root {} \;
sudo systemctl restart ndo2db
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
