Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue found in the global settings change log of Checkmk versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions. When an administrator changes global settings, the new values were recorded in the change log without proper HTML escaping. This allowed malicious HTML or JavaScript code to be stored in the log.

When other users view the Activate Changes page or the Audit log, this malicious code can execute in their browsers, potentially leading to security issues.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an administrator with permission to change global settings to inject malicious HTML or JavaScript into the change log. When other users view affected pages, this code executes in their browsers.

• It can lead to unauthorized actions performed in the context of the victim's browser session.
• It may expose sensitive information or allow attackers to manipulate the user interface.
• Since only administrators can change global settings by default, the risk is limited to trusted users with high privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored cross-site scripting in the global settings change log of Checkmk versions prior to the fixed releases. Detection involves checking if your Checkmk instance is running a vulnerable version and if any malicious HTML or JavaScript has been stored in the change log entries.

Since the vulnerability is triggered when viewing the Activate Changes page or Audit log, you can inspect these logs for suspicious or unexpected HTML or JavaScript code.

There are no specific commands provided in the resources to detect this vulnerability automatically.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade your Checkmk installation to a fixed version that addresses this issue.

The vulnerability was fixed in versions 2.5.0p5, 2.4.0p31, 2.3.0p48, and later. Applying these updates requires no manual interaction and will prevent malicious HTML or JavaScript from being stored in the change log.

Additionally, restrict administrative access to trusted users only, as only administrators can change global settings and potentially exploit this vulnerability.

Useful 0 Not Useful 0