Description

An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-14T04:16:35.107Z",
  "pubdate": "2026-09-14T04:16:35.107Z",
  "executiveSummary": "An open redirect vulnerability has been identified in the twilio_ajax_handler.php component of Nagios XI prior to version 5.9.3.\nThe vulnerability occurs due to improper validation of user-supplied input used in redirection logic, allowing an attacker to craft malicious URLs that redirect legitimate users to arbitrary, potentially malicious third-party websites.\nThis flaw facilitates phishing and social engineering attacks, as the initial link appears to originate from a trusted Nagios XI domain, increasing the likelihood of user interaction.\nSuccessful exploitation does not require authentication, making it accessible to remote unauthenticated attackers who can distribute malicious links via email, messaging platforms, or external forums.\nThe primary risk involves bypassing security filters and deceiving users into providing credentials or downloading malicious payloads on external sites, effectively leveraging the reputation of the Nagios XI installation to compromise end-users.",
  "technicalDetails": "The vulnerability resides within the twilio_ajax_handler.php file, which fails to adequately sanitize or validate parameters passed to the redirection function. In Nagios XI versions prior to 5.9.3, the application accepts an external URL input through a parameter within the AJAX request handler. Because the application logic does not implement an allowlist of permitted destinations or verify that the redirect target belongs to an authorized domain, it performs an open redirect.\nThe attack flow begins when an attacker identifies a vulnerable Nagios XI instance. The attacker constructs a crafted URL targeting twilio_ajax_handler.php, appending the desired malicious destination URL to the vulnerable parameter. When a targeted user clicks this link, the server-side logic in twilio_ajax_handler.php processes the input and executes an HTTP redirection to the attacker-controlled site.\nBecause the redirect is initiated from a legitimate, trusted Nagios XI domain, victims are less likely to perceive the danger of the destination URL. This behavior can be exploited for complex phishing campaigns where attackers replicate login pages or deploy malware. Furthermore, this vulnerability can be used to bypass client-side security controls that may trust the primary domain.\nThe root cause is the lack of strict input validation and the absence of a restrictive redirect policy within the AJAX handler. The component performs a blind redirection based on user-controlled input without checking if the target URL is relative or absolute, and without evaluating the authority component of the provided URI. There are no known authentication or privilege requirements to trigger this vulnerability, as the affected file is accessible to unauthenticated remote entities. The impact is primarily client-side; however, the architectural weakness implies a failure in secure input handling practices across the application's peripheral administrative modules. The vulnerability remains effective until the application code is updated to sanitize input parameters against a predefined list of trusted hosts."
}