Researchers have found numerous security vulnerabilities affecting the open-source platform Icinga. Exploiting the vulnerabilities could allow code execution attacks.
Icinga Vulnerabilities Discovered
Researchers from SonarSource have shared details about various vulnerabilities in Icinga software that could allow RCE attacks.
Icinga is an open-source network monitoring tool, famous due to its web interface and configurability.
As explained in the post, the SonarSource team discovered two different vulnerabilities in the software on different occasions.
First, they found a path traversal vulnerability (CVE-2022-24716) that an unauthenticated adversary could exploit to access files on the target server. Describing the impact of this flaw, the researchers stated,
If attackers can reach the database service, they can use these credentials to change the password of an existing account and gain authenticated access to the instance.
Following this arbitrary file disclosure flaw, the researchers found another vulnerability that could allow PHP code execution.
While the two vulnerabilities existed separately, an adversary could exploit them for malicious purposes in a “chained” manner.
They can be easily chained to compromise the server from an unauthenticated position if the attacker can reach the database by first disclosing configuration files and modifying the administrator’s password.
While the researchers have shared the technical details about the flaws in their post, they haven’t shared the PoC yet, given the easy exploitability of the bugs.
Patch Deployed
After discovering these vulnerabilities, the researchers reported the matter to Icinga maintainers, who acknowledged the flaws.
Consequently, the maintainers released the bug fixes with icingaweb2 versions 2.8.6, 2.9.6, and 2.10.
So now, all users should rush to update their systems with the patched Icinga versions to receive bug fixes. While prompt updates are always crucial, bugs like those, in this case, demand even more attention.
Let us know your thoughts in the comments.