// For flags

CVE-2021-32739

Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.

Icinga es un sistema de monitorización que comprueba la disponibilidad de los recursos de red, notifica a usuarios de las interrupciones y genera datos de rendimiento para informes. Desde versión 2.4.0 hasta versión 2.12.4, se presenta una vulnerabilidad que puede permitir una escalada de privilegios para usuarios autenticados de la API. Con las credenciales de un usuario de solo lectura, un atacante puede ver la mayoría de los atributos de todos los objetos de configuración, incluyendo "ticket_salt" de "ApiListener". Este salt es suficiente para calcular un ticket para cada nombre común (CN) posible. Un ticket, el certificado del nodo maestro y un certificado autofirmado son suficientes para solicitar con éxito el certificado deseado de Icinga. Ese certificado puede usarse a su vez para robar la identidad de un endpoint o de un usuario de la API. Las versiones 2.12.5 y 2.11.10 contienen una corrección de la vulnerabilidad. Como solución, se pueden especificar explícitamente los tipos consultables o filtrar los objetos ApiListener

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-05-12 CVE Reserved
  • 2021-07-15 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-11-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-267: Privilege Defined With Unsafe Actions
  • CWE-269: Improper Privilege Management
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Icinga
Search vendor "Icinga"
 Icinga
Search vendor "Icinga" for product "Icinga"
 >= 2.4.0 < 2.11.10
Search vendor "Icinga" for product "Icinga" and version " >= 2.4.0 < 2.11.10"
-
Affected
Icinga
Search vendor "Icinga"
 Icinga
Search vendor "Icinga" for product "Icinga"
 >= 2.12.0 < 2.12.5
Search vendor "Icinga" for product "Icinga" and version " >= 2.12.0 < 2.12.5"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 9.0
Search vendor "Debian" for product "Debian Linux" and version "9.0"
-
Affected