Linuxfabrik Monitoring Plugins vulnerabilities

Vulnerability in Linuxfabrik Monitoring Plugins allows reading arbitrary files via the logfile plugin, which does not confine the path to /var/log. An attacker controlling the monitoring account can read files such as /etc/shadow.

Linuxfabrik Monitoring Plugins before version 5.1.0 contains a vulnerability in the sudo policy that allows the nagios or icinga account to execute /usr/bin/apt-get as root without argument restrictions. An attacker controlling that account can use the APT::Update::Pre-Invoke option to execute arbitrary commands with root privileges, leading to full host compromise.

The redfish-* plugins in Linuxfabrik monitoring-plugins up to version 6.0.0 build request URLs by concatenating a base URL with @odata.id links from responses, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.

A vulnerability in linuxfabrik monitoring-plugins version 6.0.0 allows a local user controlling the plugin account to place a symlink that will be followed by sqlite3.connect() during a root-run log check. The database migration moves a file from /tmp using os.rename().