Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3953 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3953-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     November 16, 2024                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : icinga2     Version        : 2.12.3-1+deb11u1     CVE ID         : CVE-2021-32739 CVE-2021-32743 CVE-2021-37698 CVE-2024-49369     Debian Bug     : 991494 1087384

    Icinga 2 is a general-purpose monitoring application to fit the needs     of any size of network.

    CVE-2021-32739

        From version 2.4.0 through version 2.12.4, a vulnerability exists that         may allow privilege escalation for authenticated API users. With a         read-only user's credentials, an attacker can view most attributes of         all config objects including `ticket_salt` of `ApiListener`. This salt         is enough to compute a ticket for every possible common name (CN). A         ticket, the master node's certificate, and a self-signed certificate are         enough to successfully request the desired certificate from Icinga. That         certificate may in turn be used to steal an endpoint or API user's         identity.

    CVE-2021-32743

        In versions prior to 2.11.10 and from version 2.12.0 through version         2.12.4, some of the Icinga 2 features that require credentials for         external services expose those credentials through the API to         authenticated API users with read permissions for the corresponding         object types. An attacker who obtains these credentials can impersonate         Icinga to these services and add, modify and delete information there.

    CVE-2021-37698

        In versions 2.5.0 through 2.13.0, ElasticsearchWriter, GelfWriter,         InfluxdbWriter and Influxdb2Writer do not verify the server's certificate         despite a certificate authority being specified. Icinga 2 instances which         connect to any of the mentioned time series databases (TSDBs) using TLS         over a spoofable infrastructure should change the credentials (if any)         used by the TSDB writer feature to authenticate against the TSDB.

    CVE-2024-49369

        The TLS certificate validation in all Icinga 2 versions starting from         2.4.0 was flawed, allowing an attacker to impersonate both trusted         cluster nodes as well as any API users that use TLS client certificates         for authentication (ApiUser objects with the client_cn attribute set).

    For Debian 11 bullseye, these problems have been fixed in version     2.12.3-1+deb11u1.

    We recommend that you upgrade your icinga2 packages.

    For the detailed security status of icinga2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/icinga2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2816 advisory.

  - Icinga is a monitoring system which checks the availability of network resources, notifies users of     outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a     vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony     user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of     `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the     master node's certificate, and a self-signed certificate are enough to successfully request the desired     certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity.
    Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify     queryable types explicitly or filter out ApiListener objects. (CVE-2021-32739)

  - Icinga is a monitoring system which checks the availability of network resources, notifies users of     outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version     2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for external     services expose those credentials through the API to authenticated API users with read permissions for the     corresponding object types. IdoMysqlConnection and IdoPgsqlConnection (every released version) exposes the     password of the user used to connect to the database. IcingaDB (added in 2.12.0) exposes the password used     to connect to the Redis server. ElasticsearchWriter (added in 2.8.0)exposes the password used to connect     to the Elasticsearch server. An attacker who obtains these credentials can impersonate Icinga to these     services and add, modify and delete information there. If credentials with more permissions are in use,     this increases the impact accordingly. Starting with the 2.11.10 and 2.12.5 releases, these passwords are     no longer exposed via the API. As a workaround, API user permissions can be restricted to not allow     querying of any affected objects, either by explicitly listing only the required object types for object     query permissions, or by applying a filter rule. (CVE-2021-32743)

  - Icinga is a monitoring system which checks the availability of network resources, notifies users of     outages, and generates performance data for reporting. In versions 2.5.0 through 2.13.0,     ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer do not verify the server's certificate     despite a certificate authority being specified. Icinga 2 instances which connect to any of the mentioned     time series databases (TSDBs) using TLS over a spoofable infrastructure should immediately upgrade to     version 2.13.1, 2.12.6, or 2.11.11 to patch the issue. Such instances should also change the credentials     (if any) used by the TSDB writer feature to authenticate against the TSDB. There are no workarounds aside     from upgrading. (CVE-2021-37698)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1089-1 advisory.

  - Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will     automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3.
    (CVE-2020-29663)

  - Icinga is a monitoring system which checks the availability of network resources, notifies users of     outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a     vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony     user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of     `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the     master node's certificate, and a self-signed certificate are enough to successfully request the desired     certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity.
    Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify     queryable types explicitly or filter out ApiListener objects. (CVE-2021-32739)

  - Icinga is a monitoring system which checks the availability of network resources, notifies users of     outages, and generates performance data for reporting. In versions prior to 2.11.10 and from version     2.12.0 through version 2.12.4, some of the Icinga 2 features that require credentials for external     services expose those credentials through the API to authenticated API users with read permissions for the     corresponding object types. IdoMysqlConnection and IdoPgsqlConnection (every released version) exposes the     password of the user used to connect to the database. IcingaDB (added in 2.12.0) exposes the password used     to connect to the Redis server. ElasticsearchWriter (added in 2.8.0)exposes the password used to connect     to the Elasticsearch server. An attacker who obtains these credentials can impersonate Icinga to these     services and add, modify and delete information there. If credentials with more permissions are in use,     this increases the impact accordingly. Starting with the 2.11.10 and 2.12.5 releases, these passwords are     no longer exposed via the API. As a workaround, API user permissions can be restricted to not allow     querying of any affected objects, either by explicitly listing only the required object types for object     query permissions, or by applying a filter rule. (CVE-2021-32743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211508	Debian dla-3953 : icinga2 - security update	Nessus	Debian Local Security Checks	high
155060	Debian DLA-2816-1 : icinga2 - LTS security update	Nessus	Debian Local Security Checks	high
152064	openSUSE 15 Security Update : icinga2 (openSUSE-SU-2021:1089-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2021-32739

high

Tenable Plugins

high

high

critical