CVE-2024-41811: CSRF Vulnerability in ipl/web
Summary
CVE-2024-41811: ipl/web's ipl\Web\Common\CsrfCounterMeasure is susceptible to CSRF. Affects ipl/web versions < 0.10.1. Fixed in 0.10.1. How to fix ↓
Also tracked for
- icinga-php-library · Debian:12
The same CVE-2024-41811 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ipl/web package is a part of the Icinga project and provides common web functionality. It is used in various Icinga products, including Icinga Web, Icinga DB Web, Icinga Notifications Web, and Icinga Web JIRA Integration. The package is responsible for handling web-related tasks such as CSRF protection. However, a vulnerability has been discovered in the ipl\Web\Common\CsrfCounterMeasure component, which makes it susceptible to cross-site request forgery (CSRF) attacks.
Vulnerability Detail
Under certain circumstances, the ipl\Web\Common\CsrfCounterMeasure component in ipl/web is vulnerable to CSRF attacks. This means that an attacker can trick a user into performing unintended actions on the affected web application. The impact of this vulnerability can vary depending on the actions allowed by the application. It is important to note that all versions of the affected products are vulnerable until the icinga-php-library is upgraded to version 0.10.1 or higher.
How To Fix
Minimum fixed version
0.10.1
This is the first release that contains the fix.
composer require ipl/web:0.10.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to upgrade the icinga-php-library to the recommended version.
Conclusion
The ipl/web package used in various Icinga products is vulnerable to CSRF attacks due to a flaw in the ipl\Web\Common\CsrfCounterMeasure component. Upgrading to version 0.10.1 or higher of the icinga-php-library is necessary to fix this vulnerability. It is important to take immediate action to protect the affected web applications from potential unauthorized actions.
See every vulnerability recorded for ipl/web →
FAQ
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. This attack occurs when a malicious website or application forces a user's browser to perform unwanted actions on a trusted website where the user is authenticated.
The vulnerability affects the following products:
- Icinga Web (version 2.12.0 and above)
- Icinga DB Web (version 1.0.0 and above)
- Icinga Notifications Web (version 0.1.0 and above)
- Icinga Web JIRA Integration (version 1.3.0 and above)
The impact of this vulnerability depends on the actions allowed by the affected web application. An attacker could potentially perform unauthorized actions on behalf of the user, leading to data manipulation, privilege escalation, or other malicious activities.
To protect your application from CSRF attacks, it is important to implement proper CSRF countermeasures. This includes using anti-CSRF tokens, validating the origin of requests, and ensuring secure session management.
Yes, a fix for this vulnerability is available in version 0.10.1 of the icinga-php-library. Upgrading to this version will address the CSRF vulnerability in the ipl\Web\Common\CsrfCounterMeasure component.
References
Related vulnerabilities
Recent vulnerabilities recorded for ipl/web.
