Nagios Log Server up to 2024R2.0.2 Logstash Service unnecessary privileges

Summaryinfo

A vulnerability was found in Nagios Log Server up to 2024R2.0.2. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the component Logstash Service. This manipulation causes unnecessary privileges. This vulnerability is registered as CVE-2025-34274. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Nagios Log Server up to 2024R2.0.2. Affected by this vulnerability is an unknown function of the component Logstash Service. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. The CWE definition for the vulnerability is CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing - the attacker could execute code with root privileges, resulting in full system compromise. The Logstash service has been altered to run as the lower-privileged 'nagios' user to reduce this risk associated with a network-facing service that can accept untrusted input or load third-party components.

It is possible to read the advisory at nagios.com. This vulnerability is known as CVE-2025-34274 since 04/15/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 2024R2.0.3 eliminates this vulnerability. The upgrade is hosted for download at nagios.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Nagios

Name

• Log Server

Version

• 2024R2.0.0
• 2024R2.0.1
• 2024R2.0.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion