Listen to this Post
The vulnerability CVE-2025-53840 in Icinga DB Web stems from an improper implementation of access control filters within the dependency map visualization feature. Starting with version 1.2.0, a logic error was introduced in the code handling the `filter/hosts` and `filter/services` restrictions. When an authenticated user with permissions to view dependency maps accesses this interface, the application fails to correctly apply these configured permission filters during data retrieval for the graphical map. This allows the user to see visual nodes and connections representing monitored hosts and services that their role-based access controls should have hidden. The flaw is specific to the dependency view rendering engine; it does not affect the `filter/objects` restriction, which continues to work correctly. The system incorrectly assumes that filter checks performed at one layer are sufficient, but the dependency map component queries the database or API without re-validating user permissions against the `filter/hosts` and `filter/services` rules. Consequently, while the user cannot see the actual names of the disclosed objects or access any detail pages for them, the topology and existence of restricted elements are leaked. This information disclosure could reveal sensitive aspects of the monitoring infrastructure’s layout and relationships. The issue is resolved in version 1.2.2, where the data-fetching process for the dependency view was corrected to enforce all relevant filters at the point of query execution.
Platform: Icinga DB Web
Version: 1.2.0-1.2.1
Vulnerability: Information disclosure dependency
Severity: Medium
date: 2025-07-16
Prediction: Patched in 1.2.2
What Undercode Say:
curl -I http://$ICINGA_HOST/icingadb-web grep "version" /usr/share/icingadb-web/VERSION sudo systemctl status icingadb-web
How Exploit:
Authenticated users navigate to the Icinga DB Web dependency view interface. The application loads the dependency map data without applying `filter/hosts` and `filter/services` correctly. Attackers observe graphical nodes for restricted hosts/services, confirming their existence and connections.
Protection from this CVE
Upgrade to version 1.2.2. Apply the official patch. Alternatively, downgrade to version 1.1.3. Review and verify all access control filter configurations.
Impact:
Limited information disclosure. Reveals infrastructure topology. No direct data access. Potential reconnaissance value.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
