Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to root

Impact

lib.shell.shell_exec() built command strings from user-influenced values and split them at pipe characters before executing, so a value like the restic-check --repo parameter could append a second command to the invocation. Because these checks are typically sudo-authorized, the appended command runs as root. The identity that matters is the monitoring account: a compromised nagios or icinga user on one host becomes root on that host, and the same account and the same sudo rules usually exist on every node the monitoring system covers, so this is a fleet-wide escalation path rather than a single-box bug. On GPU nodes the monitoring agent is one of the few things installed uniformly across the whole fleet, which is what makes it worth patching everywhere rather than on the noisiest hosts.

Who can reach it

A local user who already holds the nagios or icinga account on a monitored host, or anyone who can influence the arguments a check is invoked with - for example by editing check definitions on the monitoring server. Authentication is required (CVSS PR:L); this is not remotely reachable on its own.

What to do

Upgrade to linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, which switch to argv lists with shell=False, drop the pipe splitting, and reject option-like positional values via lib.shell.safe_cli_value(). The rollout is a package update on every monitored host - no daemon restart and no reboot, since checks are executed per invocation. While you are there, narrow the sudoers entries granted to the monitoring account to the specific plugin paths rather than a wildcard.

References