Icinga 2 Filter Expression Permission Bypass Vulnerability

A vulnerability exists in Icinga 2 versions 2.4.0 to 2.15.0, allowing authenticated API users to access restricted global variables and objects through filter expressions in the '/v1/objects' endpoint. This access bypasses normal permission controls, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive global variables and objects, allowing users to obtain information that should be restricted.

Reproduction

To reproduce this vulnerability, an authenticated API user can send a request to the '/v1/objects' endpoint with a filter expression that references global variables or objects. The request will bypass the usual permission checks, allowing access to information that should be hidden.

Remediation

Users can upgrade to Icinga 2 versions 2.15.1, 2.14.7, or 2.13.13, where this vulnerability has been fixed.