911 Hack Removal

Stored XSS Vulnerability found in Nagios Log Server <= 2.1.6 - Update immediately

Updated on: August 28, 2020

Stored XSS Vulnerability found in Nagios Log Server <= 2.1.6 - Update immediately

On testing the popular log monitoring and management application, Nagios Log Server version 2.1.6 (latest at the time of testing), we found that it is vulnerable to Stored XSS attacks.

CVE ID: CVE-2020-16157


Nagios Log Server is a popular Centralized Log Management, Monitoring, and Analysis software that allows organizations to view, sort, and configure logs. Version 2.1.6 of the application was found to be vulnerable to Stored XSS.

Stored Cross Site Scripting attacks involves an attacker injecting a script (referred to as the payload) that is permanently stored (persisted) on the target application (for instance within a database). A classic example is a malicious script inserted by an attacker in a comment field on a blog or in a forum post.


An attacker (in this case, an authenticated regular user) can use this high severity vulnerability to execute malicious JavaScript aimed to steal cookies, redirect users, perform arbitrary actions on the victim’s (in this case, an admin’s) behalf, logging their keystroke and more.

The attacker does not need to find an external way of inducing other users to make a particular request containing their exploit. Rather, the attacker places their exploit into the application itself and simply waits for the victim to encounter it.


The Full Name or Username in the /profile page or /admin/users/create page is vulnerable to Stored XSS. Once a payload is saved in one of these fields, navigate to the Alerting page (/alerts) and create a new alert and select Email Users as the Notification Method. As the user list is shown, it can be seen that the payload gets executed, as shown below.


  • Vulnerability reported to the Nagios team on July 08, 2020
  • Nagios Log Server 2.1.7 containing the fix to the vulnerability released on July 28, 2020


It is highly recommended to update the application to the latest version.


Tags: , , , , , , , ,

Jinson Varghese

Jinson Varghese Behanan is an Information Security Analyst at Astra. Passionate about Cybersecurity from a young age, Jinson completed his Bachelor's degree in Computer Security from Northumbria University. When he isn’t glued to a computer screen, he spends his time reading InfoSec materials, playing basketball, learning French and traveling. You can follow him on Medium or visit his Website for more stories about the various Security Audits he does and the crazy vulnerabilities he finds.
Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Inline Feedbacks
View all comments

Psst! Hi there. We’re Astra.

We make security simple and hassle-free for thousands
of websites and businesses worldwide.

Our suite of security products include a vulnerability scanner, firewall, malware scanner and pentests to protect your site from the evil forces on the internet, even when you sleep.

earth spiders cards bugs spiders

Made with ❤️ in USA France India Germany