Description

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confining the resolved path to /var/log. An attacker who controls the monitoring account can select a root-readable file such as /etc/shadow and use --warning-regex . while leaving SUPPRESS_OUTPUT false, causing each nonempty line to be collected in warn_matches and returned through lib.base.oao(). The vulnerable flow passes the expanded scan_path directly to open(), and neither real-path containment nor an allowlist protects the sink. The same fix also confines mysql-logfile and openvpn-client-list paths, allows only documented log roots, and resolves symlinks and parent-directory traversal before checking containment. This issue is fixed in version 7.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-18T22:17:33.667Z",
  "pubdate": "2026-08-18T22:17:33.667Z",
  "executiveSummary": "Linuxfabrik Monitoring Plugins prior to version 7.0.0 contain an arbitrary file read vulnerability involving the check-plugins/logfile/logfile component, as well as mysql-logfile and openvpn-client-list.\nThe vulnerability allows an attacker who controls the monitoring account to exploit the shipped nagios or icinga sudoers allowlist, bypassing intended path restrictions.\nBy supplying a free-form path via the --filename parameter, an authenticated user with monitoring account privileges can read root-readable files such as /etc/shadow.\nThe exploitation leverages specific warning regex configurations and output suppression settings to collect and exfiltrate lines from targeted sensitive files through the monitoring output.\nThe risk implication is severe confidentiality loss, granting unauthorized access to sensitive system files with root-level privileges.\nThe issue is fully resolved in version 7.0.0 through proper path containment, symlink resolution, traversal checks, and enforcement of documented log roots.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and path containment within check-plugins/logfile/logfile, mysql-logfile, and openvpn-client-list in Linuxfabrik Monitoring Plugins prior to version 7.0.0.\nWhen invoked through the shipped nagios or icinga sudoers allowlist, the vulnerable script accepts a free-form --filename path and passes the expanded scan_path directly to the open() sink without restricting the resolved path to the expected /var/log directory.\nNeither real-path containment nor a strict allowlist protects the file open operation, allowing parent-directory traversal and arbitrary symlink resolution.\nAn attacker who controls the monitoring account initiates exploitation by executing the monitoring plugin with elevated privileges via sudo.\nThe attacker provides a targeted root-readable system file path, such as /etc/shadow, via the --filename argument.\nConcurrently, the attacker sets --warning-regex . while ensuring SUPPRESS_OUTPUT remains false.\nThis combination forces the vulnerable logic to process the file, causing each nonempty line to be collected in warn_matches.\nThe collected sensitive data is then returned through lib.base.oao(), exposing the contents of the restricted file directly within the monitoring system output.\nAuthentication and privilege requirements involve control over the monitoring account and execution capability via the configured sudoers allowlist.\nNetwork exposure is not strictly required as the attack manifests locally through the monitoring plugin invocation flow, though it impacts overall system confidentiality."
}