CVE-2021-32739 in Icinga
Summary
by MITRE • 07/15/2021
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. From version 2.4.0 through version 2.12.4, a vulnerability exists that may allow privilege escalation for authenticated API users. With a read-ony user's credentials, an attacker can view most attributes of all config objects including `ticket_salt` of `ApiListener`. This salt is enough to compute a ticket for every possible common name (CN). A ticket, the master node's certificate, and a self-signed certificate are enough to successfully request the desired certificate from Icinga. That certificate may in turn be used to steal an endpoint or API user's identity. Versions 2.12.5 and 2.11.10 both contain a fix the vulnerability. As a workaround, one may either specify queryable types explicitly or filter out ApiListener objects.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2025
The vulnerability described in CVE-2021-32739 affects Icinga monitoring systems version 2.4.0 through 2.12.4, representing a critical privilege escalation flaw that undermines the security posture of network monitoring infrastructure. This vulnerability specifically targets the API authentication mechanisms within Icinga, creating a pathway for authenticated users with read-only privileges to gain unauthorized access to sensitive configuration data. The flaw stems from insufficient access controls that allow unauthorized data exposure, enabling attackers to extract critical cryptographic parameters that should remain protected within the system's security boundaries.
The technical exploitation of this vulnerability relies on the exposure of the `ticket_salt` parameter associated with the `ApiListener` configuration object, which according to CWE-284 access control flaws, represents a failure in proper authorization enforcement. This salt value serves as a cryptographic component that, when combined with knowledge of common names, enables an attacker to compute valid authentication tickets for any endpoint within the Icinga infrastructure. The vulnerability operates under the ATT&CK framework's privilege escalation tactics, specifically targeting the credential access and defense evasion domains where attackers can manipulate authentication mechanisms to assume the identity of other system components.
The operational impact of this vulnerability extends beyond simple data exposure, as it enables comprehensive identity theft within the Icinga ecosystem. An attacker who successfully exploits this flaw can request certificates for any endpoint or API user, effectively allowing them to impersonate legitimate system components and potentially gain access to additional resources within the monitored network. This creates a cascading security risk where a single compromised read-only account can lead to full system compromise, making the vulnerability particularly dangerous in enterprise environments where monitoring systems typically maintain elevated privileges and access to critical infrastructure.
The fix implemented in versions 2.12.5 and 2.11.10 addresses this vulnerability by strengthening access controls around sensitive configuration objects, ensuring that the `ticket_salt` parameter and related cryptographic data remain properly protected from unauthorized access. Organizations can implement mitigations through explicit query type specification or by filtering out ApiListener objects from unauthorized access, effectively reducing the attack surface. This vulnerability highlights the importance of proper privilege separation and the principle of least privilege in monitoring systems, where the exposure of cryptographic parameters can fundamentally compromise the entire security architecture. The remediation approach aligns with industry best practices for preventing information disclosure vulnerabilities and maintaining the integrity of authentication systems within distributed monitoring environments.