PT-2018-14381 · Icinga+1 · Icinga Web 2+1

Published 2018-12-17 · Updated 2020-01-16 · CVE-2018-18249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2

Description The issue allows for the injection of PHP ini-file directives through environment variables. This can be achieved by sending specific information to the attacker, such as using a name parameter with a value like ${PATH} ${APACHE RUN DIR} ${APACHE RUN USER} in API endpoints like "/icingaweb2/navigation/add" or "/icingaweb2/dashboard/new-dashlet".

Recommendations For versions prior to 2.6.2, update to version 2.6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /icingaweb2/navigation/add and /icingaweb2/dashboard/new-dashlet API endpoints to minimize the risk of exploitation. Avoid using the name parameter with untrusted input in these endpoints until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-18249

OPENSUSE-SU-2020:0067-1

OPENSUSE-SU-2020_0067-1

OPENSUSE-SU-2024:10857-1

Affected Products

Icinga Web 2

Suse

References · 33

• 🔥 https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180030.txt · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2020:0067-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-18249 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18249 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18249 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18249 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18249 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-18249 · Vendor Advisory
• https://github.com/Icinga/icingaweb2/milestone/51?closed=1 · Note
• https://github.com/Icinga/icingaweb2/issues/3535 · Note
• https://suse.com/security/cve/CVE-2018-18248 · Note
• https://suse.com/security/cve/CVE-2018-18249 · Note
• https://bugzilla.suse.com/1119799 · Note