CVE-2024-41811

What it actually does

Cross-site request forgery (CSRF) in ipl/web web components allows forged requests from authenticated sessions under specific conditions, bypassing intended action authorization.

Why it matters to the business

Attackers could cause unauthorized configuration or monitoring changes in affected Icinga deployments, increasing operational risk and potential downtime until libraries are updated.

How an attack unfolds

An attacker creates a malicious page that submits forged HTTP requests; when an authenticated administrator visits the page, the browser sends the request using existing session credentials, executing unintended actions.

How to fix it

Upgrade icinga-php-library to version 0.14.1 or newer, which incorporates the ipl/web fix from commit f4a7411791527935c426266f0aca0dba38f02780; verify the library version after update.

How to confirm the fix worked

Confirm icinga-php-library version is at least 0.14.1 and inspect source for CSRF token or same-origin checks added in the referenced commit.

Typical attack path

1. Identify a running instance using vulnerable ipl/web components
2. Craft a CSRF payload targeting a state-changing endpoint
3. Host the payload on an attacker-controlled site
4. Lure an authenticated privileged user to visit the malicious page
5. Trigger unauthorized actions via the victim's session

How to detect it

Examine web server access logs for state-changing requests lacking expected referer or origin headers; correlate with user activity timelines to spot actions performed without direct user interaction.

What your security team should do

• Upgrade icinga-php-library to 0.14.1 immediately across all instances
• Audit web applications for additional CSRF protections on sensitive endpoints
• Review access logs for unexpected state-changing requests from authenticated sessions
• Educate administrators on avoiding untrusted links while logged into management interfaces