Checkmk vulnerabilities

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.

In Checkmk versions <2.4.0p23, <2.3.0p45, and 2.2.0, there is a vulnerability related to the exposure of the session signing secret. An administrator of a remote site with config sync enabled can hijack sessions on the central site by forging session cookies.

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

In Checkmk versions <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL), insufficiently protected credentials in host and folder configuration endpoints of the REST API allow an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases and IPMI passwords in clear text from GET responses, although the setup GUI never displays these values.

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

In Checkmk versions before 2.5.0p10, improper certificate validation allows a relay and a push agent sharing the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

Missing authorization in Checkmk versions <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.

Improper authentication in the agent receiver of Checkmk before 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only Cloud, Ultimate, and Ultimate MT editions are affected.

An incorrect authorization vulnerability in frozen BI aggregations in Checkmk (versions <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0) allows an authenticated user with restricted host and service visibility to learn the names and existence of hosts and services they are not authorized to see.

Missing authorization in Checkmk before versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules.

A privilege escalation vulnerability in Checkmk allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. The mk_sap_hana agent plugin, running as root, derives instance identifiers from the process list and uses them to build a command executed with elevated privileges.

Stored XSS in service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to inject malicious HTML/JavaScript into check output.

Improper neutralization of HTML-encoded characters in URL validation in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an authenticated user to bypass URL validation and inject malicious URLs like javascript: URIs, leading to XSS.

Stored XSS in global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to store malicious HTML/JavaScript in changelog messages.

Checkmk before version 2.5.0p5 has an incorrect authorization vulnerability in the User Messages dashboard widget. Message-fetching endpoints return the dashboard creator's messages instead of the viewer's, allowing an attacker with a valid public dashboard share token to read the issuer's personal messages.

Stored XSS in URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme like javascript:.

Checkmk version 2.5.0 (beta) before 2.5.0b2 contains a stored XSS vulnerability. Authenticated users with permission to create hosts or services can inject arbitrary JavaScript that executes in other users' browsers during Unified Search.

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2.4.0p18 and all versions of Checkmk 2.3.0. This potentially allowed unauthorized triggering of predefined alert handlers on hosts where the handler was deployed.

Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, which could lead to information disclosure.