CVE-2025-30164: Icinga Web 2 Auth Bypass Vulnerability

CVE-2025-30164 Overview

CVE-2025-30164 is an open redirect vulnerability [CWE-601] in Icinga Web 2, an open source monitoring web interface, framework, and command-line interface. The flaw affects versions prior to 2.11.5 and 2.12.3. An attacker can craft a malicious URL that, once visited by an authenticated user or one able to authenticate, manipulates the backend to redirect the user to an attacker-controlled location. The Icinga project resolved the issue in versions 2.11.5 and 2.12.3. No known workarounds are available.

Critical Impact
Attackers can leverage the redirect to stage phishing campaigns against Icinga administrators, harvesting credentials or delivering malware while abusing the trust of the legitimate monitoring domain.

Affected Products

Icinga Web 2 versions prior to 2.11.5
Icinga Web 2 versions 2.12.0 through 2.12.2
Deployments exposing the web interface to authenticated users

Discovery Timeline

2025-03-26 - CVE-2025-30164 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30164

Vulnerability Analysis

The vulnerability is an open redirect classified under [CWE-601], URL Redirection to Untrusted Site. Icinga Web 2 accepts a redirect target parameter without sufficient validation of the destination host. An attacker crafts a URL that references the Icinga Web 2 backend but embeds an external destination. When an authenticated user clicks the link, the application processes the request and redirects the browser to the attacker-supplied location.

The attack requires user interaction, which reduces the exploitation barrier only slightly because Icinga Web 2 users routinely follow monitoring links shared through alerts, tickets, and chat notifications. The scope change reflects that the redirect crosses the trust boundary of the Icinga application into an untrusted destination controlled by the attacker.

Root Cause

The root cause is insufficient validation of user-supplied redirect targets in the Icinga Web 2 request handling logic. The backend accepts a redirect destination without enforcing an allow list of trusted hosts or verifying that the target is relative to the Icinga application. Details are documented in the GitHub Security Advisory GHSA-8r73-6686-wv8q.

Attack Vector

An attacker crafts a URL pointing to the Icinga Web 2 host with a manipulated redirect parameter. The attacker distributes the URL via phishing email, chat, or a compromised page. An authenticated Icinga user, or a user who authenticates when prompted, follows the link. The application accepts the request and issues an HTTP redirect to the attacker-controlled host, which typically hosts a credential-harvesting clone of the Icinga login page or a malware payload.

No verified public proof-of-concept exploit is available. The vulnerability mechanism is described in the Icinga Security Advisory.

Detection Methods for CVE-2025-30164

Indicators of Compromise

HTTP requests to Icinga Web 2 endpoints containing redirect or URL parameters that reference external domains
Web server access logs showing 302 or 303 responses from Icinga Web 2 with Location headers pointing outside the deployment domain
Referrer logs on external phishing infrastructure showing origin from the Icinga Web 2 host

Detection Strategies

Parse Icinga Web 2 access logs for query parameters containing fully qualified URLs or protocol-relative references
Alert on outbound redirects from the Icinga Web 2 base URL to hosts not on an internal allow list
Correlate authenticated user session events with subsequent redirects to previously unseen external domains

Monitoring Recommendations

Enable verbose logging on the reverse proxy or web server fronting Icinga Web 2 to capture full request URIs and response Location headers
Feed web server and Icinga application logs into a centralized SIEM for pattern-based detection of redirect abuse
Monitor phishing intelligence feeds for lookalike Icinga login pages targeting the organization

How to Mitigate CVE-2025-30164

Immediate Actions Required

Upgrade Icinga Web 2 to version 2.11.5 or 2.12.3 or later without delay
Audit web server logs for suspicious redirect activity dating back to the deployment of vulnerable versions
Notify Icinga Web 2 users about the phishing risk and reinforce link-hover verification practices

Patch Information

The Icinga project released fixes in Icinga Web 2 v2.11.5 and Icinga Web 2 v2.12.3. Administrators running the 2.11.x branch should upgrade to 2.11.5, and those on the 2.12.x branch should upgrade to 2.12.3. Refer to the GitHub Security Advisory GHSA-8r73-6686-wv8q for advisory details.

Workarounds

No workarounds are available according to the vendor advisory; patching is the only supported remediation
Restrict access to Icinga Web 2 to trusted networks using firewall or VPN controls to reduce exposure while planning the upgrade
Configure the upstream reverse proxy to strip or validate suspicious redirect parameters where feasible

bash

# Example: verify installed Icinga Web 2 version and upgrade on Debian/Ubuntu
icingacli --version
sudo apt update
sudo apt install --only-upgrade icingaweb2
icingacli --version