CVE-2025-61789: Icinga DB Web Information Disclosure Flaw

CVE-2025-61789 Overview

CVE-2025-61789 affects Icinga DB Web, the graphical interface for the Icinga monitoring platform. An authenticated user with access to Icinga DB Web can abuse custom variable filters to infer values of variables that administrators intended to hide. The variables are protected by icingadb/protect/variables or restricted via icingadb/denylist/variables, but the filter query behavior allows attackers to guess assigned values through response-based inference. This qualifies as an observable response discrepancy issue tracked under [CWE-204]. Versions 1.1.4 and 1.2.3 remediate the flaw by returning an error when a protected or denylisted custom variable is used in a filter.

Critical Impact
Authorized Icinga DB Web users can extract sensitive custom variable values, such as credentials, tokens, or internal identifiers, that were configured as hidden or protected.

Affected Products

Icinga DB Web versions prior to 1.1.4 (1.1.x branch)
Icinga DB Web versions prior to 1.2.3 (1.2.x branch)
Deployments relying on icingadb/protect/variables or icingadb/denylist/variables for confidentiality

Discovery Timeline

2025-10-16 - CVE-2025-61789 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61789

Vulnerability Analysis

Icinga DB Web enforces confidentiality on custom variables through two configuration mechanisms. The protect/variables directive masks variable values in the interface, while denylist/variables hides them entirely from view. Both controls apply at the presentation layer.

The filter subsystem did not enforce the same restrictions. An authorized user could construct a filter expression referencing a protected or denylisted custom variable and observe whether matching monitored objects appeared in the result set. By iterating over candidate values, the attacker performs an oracle-style guessing attack and reconstructs the hidden data.

The issue is exploitable by any authenticated account with query access to the Icinga DB Web interface. No elevated privileges are required beyond standard read access.

Root Cause

The root cause is inconsistent enforcement of column restrictions. Access control was implemented in the rendering layer but omitted from the SQL filter assembly path. Query results reflected the presence or absence of matching rows, which acted as a side channel disclosing protected variable content [CWE-204].

Attack Vector

Exploitation occurs remotely over the network through the standard Icinga DB Web application interface. An authenticated user submits filter queries targeting a specific custom variable name with candidate values. The application returns filtered object lists that confirm or deny each guess, enabling systematic enumeration of protected values.

php

// Patch: library/Icingadb/Common/Model.php
<?php

/* Icinga DB Web | (c) 2025 Icinga GmbH | GPLv2 */

namespace Icinga\Module\Icingadb\Common;

use ipl\Orm\Query;
use ipl\Sql\Connection;

abstract class Model extends \ipl\Orm\Model
{
    public static function on(Connection $db)
    {
        $query = parent::on($db);

        return $query->on(
            Query::ON_SELECT_ASSEMBLED,
            function () use ($query) {
                $auth = new class () {
                    use Auth;
                };

                $auth->assertColumnRestrictions($query->getFilter());
            }
        );
    }
}

The patch introduces a base Model class that hooks into query assembly. It invokes assertColumnRestrictions() against the active filter, rejecting queries that reference protected or denylisted columns before the SQL executes. Source: Icinga/icingadb-web commit 5e982da.

Detection Methods for CVE-2025-61789

Indicators of Compromise

Repeated Icinga DB Web filter requests targeting the same custom variable name with varying candidate values from a single user session
Application logs showing high-volume filter queries against columns configured in icingadb/protect/variables or icingadb/denylist/variables
Web server access logs with sequential or dictionary-style query parameter patterns against Icinga DB Web endpoints

Detection Strategies

Audit Icinga DB Web query logs for filters that reference variable names listed in the protection or denylist configuration
Correlate authenticated user sessions with query volume and diversity of filter values against the same field
Deploy web application firewall rules that flag high-frequency filter parameter enumeration against /icingadb/ routes

Monitoring Recommendations

Forward Icinga web server and application logs to a centralized analytics platform for behavioral baselining
Alert on any authenticated Icinga session generating an unusually high number of unique filter queries within a short window
Track the deployed Icinga DB Web version across all monitoring instances and alert on installations below 1.1.4 or 1.2.3

How to Mitigate CVE-2025-61789

Immediate Actions Required

Upgrade Icinga DB Web to version 1.1.4 (for the 1.1.x branch) or 1.2.3 (for the 1.2.x branch)
Review which custom variables are configured under icingadb/protect/variables and icingadb/denylist/variables and rotate any secrets that may have been exposed
Audit Icinga DB Web user accounts and remove access for users who no longer require it

Patch Information

The fix is delivered in Icinga DB Web 1.1.4 and 1.2.3. The corrective commit adds a base Model class that enforces column restrictions at query assembly through assertColumnRestrictions(), rejecting filters targeting protected or denylisted variables. Full details are in the GitHub Security Advisory GHSA-w57j-28jc-8429 and the upstream commit.

Workarounds

Restrict Icinga DB Web access to a minimal set of trusted operators until the patched version is deployed
Avoid storing highly sensitive values such as passwords or API tokens as Icinga custom variables; use dedicated secrets management instead
Place Icinga DB Web behind a reverse proxy with strict authentication and request rate limiting to constrain enumeration attempts

bash

# Verify installed Icinga DB Web version and upgrade via package manager
icingacli module list | grep icingadb

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade icingadb-web

# RHEL/Rocky/AlmaLinux
sudo dnf upgrade icingadb-web

# Confirm patched version (>= 1.1.4 or >= 1.2.3)
icingacli module list | grep icingadb