^{CVE-2021-32747:}Icinga Web 2 vulnerability exposes protected custom variables to unauthorized users through an undocumented URL parameter, potentially revealing sensitive information like authentication credentials.

A security vulnerability (CVE-2021-32747) affects Icinga Web 2 versions 2.0.0 through 2.8.2. The issue allows unauthorized access to custom variables that may contain sensitive information such as authentication credentials. While Icinga Web 2 normally implements protection rules and blacklists to hide or mask sensitive custom variables in the UI, these security measures can be bypassed using an undocumented URL parameter. When this parameter is added to certain routes, the application displays these protected custom variables in list views and exports (JSON or CSV), completely ignoring the configured protection rules and blacklists. This exposes sensitive information that should remain hidden, potentially leading to unauthorized access to monitored systems.

Overview

Icinga Web 2 is an open-source monitoring web interface and framework used to monitor IT infrastructure. The vulnerability affects all versions from 2.0.0 to 2.8.2 and involves the exposure of custom variables that may contain sensitive information like authentication credentials. Custom variables in Icinga 2 are user-defined key-value pairs attached to configuration objects, often containing secrets used for authentication with monitored services. While Icinga Web 2 provides mechanisms to protect these variables through protection rules (masking values with asterisks) and blacklists (hiding variables entirely), these protections can be completely bypassed by using an undocumented URL parameter. This parameter, when added to certain routes, causes the application to include these protected custom variables in list views and exports, revealing sensitive information that should remain hidden according to the configured security policies.

Remediation

To address this vulnerability, users should upgrade to one of the following patched versions:

• Version 2.9.0 or later
• Version 2.8.3 or later (if on the 2.8.x branch)
• Version 2.7.5 or later (if on the 2.7.x branch)

If immediate upgrading is not possible, a temporary workaround can be implemented by setting up restrictions to hide hosts and services that contain sensitive custom variables entirely. This approach limits functionality but prevents exposure of sensitive data until a proper upgrade can be performed.

References

• Icinga Web 2 v2.7.5 Release: https://github.com/Icinga/icingaweb2/releases/tag/v2.7.5
• Icinga Web 2 v2.8.3 Release: https://github.com/Icinga/icingaweb2/releases/tag/v2.8.3
• Icinga Web 2 v2.9.0 Release: https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0
• GitHub Security Advisory: https://github.com/Icinga/icingaweb2/security/advisories/GHSA-2xv9-886q-p7xx
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor