Monitoring Plugins
Monthly
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects the redfish-* check plugins used with Icinga, Nagios, and compatible systems. The plugins build Redfish request URLs by blindly concatenating the operator-supplied base URL with @odata.id links returned in the BMC response, so a malicious or compromised BMC can redirect the plugin's authenticated follow-up requests to an attacker-controlled host and harvest the X-Auth-Token session token or HTTP Basic credentials sent with them. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.3.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
Credential and authentication-token disclosure in Linuxfabrik monitoring-plugins (versions 6.0.0 and earlier) affects the redfish-* check plugins used with Icinga, Nagios, and compatible systems. The plugins build Redfish request URLs by blindly concatenating the operator-supplied base URL with @odata.id links returned in the BMC response, so a malicious or compromised BMC can redirect the plugin's authenticated follow-up requests to an attacker-controlled host and harvest the X-Auth-Token session token or HTTP Basic credentials sent with them. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.3.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.