CVE-2022-24716 PoC — Path traversal in Icinga Web 2

Source

https://github.com/pumpkinpiteam/CVE-2022-24716

Associated Vulnerability

Title: Path traversal in Icinga Web 2 (CVE-2022-24716)
Description:Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This issue has been resolved in versions 2.9.6 and 2.10 of Icinga Web 2. Database credentials should be rotated.

Readme

# CVE-2022-24716

Exploit for the vulnerability: Arbitrary File Disclosure Vulnerability in Icinga Web 2 <2.8.6, <2.9.6, <2.10

https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/

Help:

`python3 exploit.py -h`

Usage example:

`python3 -u http://127.0.0.1:8080 -f /etc/passwd`

DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →