Privilege escalation in Icinga
CVE-2021-32739
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (66.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 66.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Icinga
- Icinga Icinga2 — versions >= 2.4.0, <= 2.12.4
- Debian Linux — versions 9.0
Weakness classification (CWE)
References
- github.com/Icinga/icinga2/security/advisories/GHSA-98wp-jc6q-x5q5 (Exploit, Third Party Advisory)
- icinga.com/blog/2021/07/02/releasing-icinga-2-12-5-2-11-10/ (Broken Link, Vendor Advisory)
- lists.debian.org/debian-lts-announce/2021/11/msg00010.html (mailing-list, Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2021-32739?
- CVE-2021-32739 is a high-severity vulnerability in Icinga, classified under Privilege Defined With Unsafe Actions. CVSS score: 8.8/10. Published 2021-07-15.
- How severe is CVE-2021-32739?
- High severity. CVSS v3 base score is 8.8 out of 10.