A vulnerability in Nagios Log Server allows authenticated users to trigger an unauthorized service termination, posing a significant risk to system availability.

This flaw is an incorrect authorization issue (CWE-863) within the API, where a user with restricted read-only privileges can invoke a system command to stop the Elasticsearch subsystem. The attack is triggered via a specific API call to the system endpoint, despite the interface providing a misleading error message upon execution.

The ability to stop the Elasticsearch service causes a denial-of-service for the log management platform, preventing the ingestion and analysis of critical security logs. With a CVSS score of 8.5, this high-severity vulnerability threatens operational continuity and the integrity of security monitoring infrastructure. If exploited, an organization may lose visibility into network events, potentially masking further malicious activity.

Immediate Action: Upgrade Nagios Log Server to version 2024R1.3.2 or later to apply the necessary authorization checks.

Proactive Monitoring: Audit API access logs for unauthorized or unexpected calls to the system management endpoints, specifically searching for patterns related to the Elasticsearch service control.

Compensating Controls: Restrict network access to the Nagios Log Server API to trusted internal administrative segments, and ensure that only strictly necessary personnel are granted API access credentials.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced by the CVE record.

Given the availability of a public proof-of-concept and the potential for severe service disruption, administrators should prioritize this update. Ensure that all Nagios Log Server instances are patched to version 2024R1.3.2 immediately to prevent unauthorized service termination and maintain the reliability of your logging infrastructure.