CVE-2025-44823: Nagios Log Server Information Disclosure

CVE-2025-44823 Overview

CVE-2025-44823 is an information disclosure vulnerability in Nagios Log Server versions prior to 2024R1.3.2. The flaw allows any authenticated user to retrieve cleartext administrative API keys through the /nagioslogserver/index.php/api/system/get_users endpoint. The issue is tracked internally by Nagios as GL:NLS#475 and is classified under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

An attacker with low-privilege credentials can call the affected endpoint, harvest administrator API keys, and then act with full administrative authority over the Log Server instance.

Critical Impact

Any authenticated low-privilege user can extract administrative API keys in cleartext, enabling full administrative takeover of the Nagios Log Server instance.

Affected Products

• Nagios Log Server 2024 R1
• Nagios Log Server 2024 R1.0.1, R1.0.2, R1.1, R1.2, R1.3
• Nagios Log Server 2024 R1.3.1

Discovery Timeline

• 2025-10-07 - CVE-2025-44823 published to NVD
• 2025-11-06 - Last updated in NVD database

Technical Details for CVE-2025-44823

Vulnerability Analysis

The vulnerability resides in the api/system/get_users endpoint of the Nagios Log Server web interface. The endpoint returns user records that include the api_key field in cleartext for every account, including administrative accounts. Authorization checks on the endpoint validate only that the caller is authenticated, not that the caller has administrative rights or owns the records being returned.

Nagios API keys function as bearer credentials. Possession of an administrator's key permits direct access to administrative API functions without further authentication. This converts a low-privilege session into full administrative control of the logging platform and the data it ingests.

Security logging platforms typically aggregate sensitive telemetry from across the enterprise. Compromise of the Log Server therefore exposes log contents, configuration data, and any integrations that trust the server's API.

Root Cause

The root cause is improper segregation of sensitive fields in the API response combined with insufficient authorization on the get_users call. Sensitive credentials should never be returned to non-administrative callers, and they should not be stored or transmitted in cleartext where alternative reference tokens would suffice.

Attack Vector

Exploitation requires network access to the Log Server web interface and any valid user account. The attacker authenticates, issues a GET request to /nagioslogserver/index.php/api/system/get_users, parses the JSON response for the api_key value associated with an administrative user, and then reuses that key against administrative API endpoints. No user interaction is required beyond the initial authentication.

A technical proof of concept is referenced in Exploit-DB #52177. See the advisory for the request structure and response handling details.

Detection Methods for CVE-2025-44823

Indicators of Compromise

• HTTP GET requests to /nagioslogserver/index.php/api/system/get_users originating from non-administrative user sessions.
• Subsequent API calls using an administrator's api_key from a source IP or user-agent that does not match the administrator's normal activity pattern.
• Unexpected administrative configuration changes, new user creations, or index modifications following access to the get_users endpoint.

Detection Strategies

• Monitor Nagios Log Server access logs for calls to api/system/get_users and correlate the calling session's privilege level with the response size.
• Alert on API key reuse from multiple distinct source IP addresses within short time windows.
• Baseline normal administrative API usage and flag deviations such as off-hours activity or new client IPs presenting administrator keys.

Monitoring Recommendations

• Forward Nagios Log Server web and audit logs to a central SIEM and retain at least 90 days for retrospective hunting.
• Track authentication events for all Log Server accounts and review any privilege changes performed via API.
• Periodically audit which accounts have valid API keys and rotate keys on a defined schedule.

How to Mitigate CVE-2025-44823

Immediate Actions Required

• Upgrade Nagios Log Server to version 2024R1.3.2 or later.
• Rotate all administrative API keys after upgrading, treating any pre-patch keys as compromised.
• Review existing user accounts and remove any unused or unrecognized accounts that could be used to trigger the endpoint.
• Restrict network access to the Log Server management interface to trusted administrative networks.

Patch Information

Nagios addressed the issue in Nagios Log Server 2024R1.3.2. Release details are available in the Nagios Changelog Update. Apply the vendor patch as the primary remediation; configuration changes alone cannot close the underlying authorization gap.

Workarounds

• Limit Log Server account creation to trusted administrators until the patch is applied.
• Place the Log Server behind a reverse proxy or web application firewall that blocks requests to api/system/get_users from non-administrative sessions.
• Enforce network-level access controls so that only management workstations can reach the Log Server web interface.