Disclaimer: Three of the security issues referenced below do not yet have public CVE identifiers, so they are referenced by their GHSA ID. This post will be updated as soon as CVEs become available.
Important: Icinga Web 2 security update
Type/Severity
NetEye Product Security has rated this update as having a High security impact.
Topic
Updates for the Icinga Web 2 packages are now available for NetEye 4.
Security Fix for NetEye 4.50
icingaweb2-2.12.7_neteye1.158.2-1icingaweb2-module-analytics-1.65.1-1icingadb-web-1.1.4_neteye1.12.5-1icingaweb2-module-assetmanagement-1.44.2-1
CVEs
- GHSA-mph2-hvq4-8423
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L - GHSA-jff6-vjrf-q9gj
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - GHSA-fmf2-272p-p3r9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - CVE-2026-61637
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
The most severe issue is an Improper Control of Generation of Code in the standalone chart endpoints svg/chart.php and png/chart.php. These endpoints require no authentication. An unauthenticated attacker can inject LESS functions through the colors parameter and read any file the web server’s PHP process can access. This includes the Icinga Web configuration with database and LDAP credentials, and module configuration with Icinga 2 API credentials. The same endpoints also suffer from an Allocation of Resources Without Limits or Throttling: requests with thousands of chart slices can exhaust the server’s CPU and make Icinga Web unresponsive.
A second high-severity issue is an Improper Neutralization of Wildcards in the database and LDAP authentication and group backends. A user who logs in with a name containing * (for example abc* instead of abc) can receive the group memberships, and so the roles and permissions, of other users whose names match the pattern, up to full administrative access.
Icinga Web 2 is also affected by an Authorization Bypass Through User-Controlled Key on the My Devices page: any authenticated user who knows a device fingerprint can remove another user’s remembered devices, which ends that user’s “stay logged in” session. Finally, an Open Redirect on the login page lets an attacker send a user with a non-default locale to an attacker-controlled URL after authentication.
Together, these issues can lead to unauthenticated disclosure of credentials and configuration files, privilege escalation to administrative access, denial of service, and phishing through redirection.
With this update, the legacy monitoring module is no longer part of Icinga Web 2 and is no longer shipped by NetEye. The NetEye modules that still used its hooks were moved to their Icinga DB Web counterparts:
- Analytics: The host and service action links now use the Icinga DB Web hooks.
- Asset Management: The GLPI host details hook now uses Icinga DB Web.
- Icinga DB Web: The upstream compatibility layer for monitoring module hooks replaces a NetEye-specific patch that required the monitoring module files to be present.
Affected Products
All NetEye 4.x versions >= 4.31.
References
- https://neteye.guide/current/security-policy/bugfix-policy.html#severity-levels
- https://github.com/Icinga/icingaweb2/security/advisories/GHSA-mph2-hvq4-8423
- https://github.com/Icinga/icingaweb2/security/advisories/GHSA-jff6-vjrf-q9gj
- https://github.com/Icinga/icingaweb2/security/advisories/GHSA-fmf2-272p-p3r9
- https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv
Patrick Harasser
Author
