Critical JavaScript Injection Vulnerability in Icinga Web 2
Summary
DEBIAN-CVE-2025-27405: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Affects icingaweb2 versions < 2.12.4-1. Fixed in 2.12.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Icinga Web 2 is an open-source monitoring web interface that provides a framework and command-line interface for monitoring systems and services. It is designed to be user-friendly and extensible, allowing users to create custom dashboards and reports. However, certain versions of Icinga Web 2 are vulnerable to a security flaw that permits attackers to inject arbitrary JavaScript into the application, potentially compromising user accounts and data.
Vulnerability Detail
The vulnerability exists in Icinga Web 2 versions prior to 2.11.5 and 2.12.13. It allows an attacker to craft a malicious URL that, when accessed by any user, can execute arbitrary JavaScript within the context of Icinga Web. This could lead to unauthorized actions being performed on behalf of the user, including data theft or manipulation. The flaw arises from inadequate input validation and a lack of proper content security policies.
How To Fix
Minimum fixed version
2.12.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade icingaweb2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users running Icinga Web 2.12.2 can enable a content security policy in the application settings to mitigate the risk of JavaScript injection. This can be done by modifying the application configuration to include a strict content security policy that restricts the sources from which scripts can be loaded.
Conclusion
The identified vulnerability in Icinga Web 2 poses a significant risk to users, allowing for potential JavaScript injection and unauthorized actions. It is crucial for users to update to the latest patched versions to ensure the security of their systems. Additionally, implementing a content security policy can serve as a temporary measure to mitigate risks until the update is applied.
See every vulnerability recorded for icingaweb2 →
FAQ
The vulnerability allows attackers to inject arbitrary JavaScript into the application, which can lead to unauthorized actions being performed on behalf of users.
Versions prior to 2.11.5 and 2.12.13 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update your Icinga Web 2 installation to version 2.11.5 or 2.12.3 or later to fix the vulnerability.
Yes, you can enable a content security policy in the application settings as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for icingaweb2.
