Yann Castel

Name of the Vulnerable Software and Affected Versions: NSClient++ version 0.5.2.35 Description: A local privilege escalation issue exists when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. An attacker can extract this password, authenticate to the NSClient++ web interface (typically accessible on port 8443), and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM. This can be done by registering a custom script, saving the configuration, and triggering it via the API. Recommendations: For NSClient++ version 0.5.2.35, consider disabling the ExternalScripts feature and restricting access to the web interface until a secure configuration or update is available. As a temporary workaround, restrict access to the nsclient.ini configuration file to prevent local users from reading the administrative password.

Name of the Vulnerable Software and Affected Versions: NSClient++ version 0.5.2.35 Description: An authenticated remote code execution issue exists when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface, inject arbitrary commands as external scripts via the "/settings/query.json" API endpoint, save the configuration, and trigger the script via the "/query/{name}" endpoint. The injected commands are executed with SYSTEM privileges, enabling full remote compromise. This capability is an intended feature, but the lack of safeguards or privilege separation makes it risky when exposed to untrusted actors. Recommendations: For NSClient++ version 0.5.2.35, consider disabling the ExternalScripts module or restricting access to the web interface to minimize the risk of exploitation. As a temporary workaround, restrict access to the "/settings/query.json" and "/query/{name}" API endpoints until a patch is available. Avoid using the ExternalScripts module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.