Linuxfabrik monitoring plugins: sudo-authorized checks read arbitrary root-readable files via --test

Impact

lib.lftest.test() treated an element of the --test CSV argument as a filesystem path and returned the file's contents as simulated plugin output, with no path confinement. The --test argument is hidden but accepted in production, and these checks are normally invoked through sudo from the monitoring account, so an attacker holding the nagios or icinga user reads any root-readable file on the host. deb-updates with its default QUERY=1 discloses a file line by line; roughly 22 other plugins leak filtered content or act as a root-file existence and readability oracle, and network-bonding and openstack-swift-stat had direct read paths of their own. Monitoring agents are installed identically on every node, so one compromised monitoring account scales to fleet-wide disclosure of kubeconfigs, BMC and Redfish credentials, and private keys.

Who can reach it

Local attacker who controls the nagios or icinga service account on a monitored host, using the sudo rules those plugins are normally authorized under. No further authentication needed.

What to do

Upgrade linuxfabrik-lib to 6.1.0 and Linuxfabrik Monitoring Plugins to 7.0.0 — the library fix confines fixture reads to the invoking plugin's unit-test directory and refuses unsafe anchors, and the plugin fix routes the two direct-read bypasses through that helper. Package update on every monitored host plus a monitoring agent restart; no reboot. Also review the sudo rules granted to the monitoring account while you are there.

References